Relying homeassistant and octoprint login errors to host rsyslog

homeassistant.conf

# /etc/rsyslog.d/homeassistant.conf on client
# Enabling logging in HA
# logger:
#   logs:
#     homeassistant.components.http.ban: warning


if ($programname == 'homeassistant' and $msg contains 'Login attempt or request with invalid authentication') then {
  $ActionQueueFileName fwdRule1
  $ActionQueueMaxDiskSpace 1g
  $ActionQueueSaveOnShutdown on
  $ActionQueueType LinkedList
  $ActionResumeRetryCount -1
  *.* @@192.168.0.100:514
}

logger.yaml

# ~/.octoprint/logging.yaml on octoprint client

loggers:
  AUTH:
    handlers:
      - authFile
      - console

octoprint.conf

# /etc/rsyslog.d/octoprint.conf on client

template(name="OctoprintTemplate" type="list") {
    constant(value="<")
    property(name="pri")
    constant(value=">")
    property(name="timestamp" dateFormat="rfc3339")
    constant(value=" ")
    property(name="hostname")
    constant(value=" ")
    constant(value="octoprint")
    property(name="msg" spifno1stsp="on" )
    property(name="msg")
}

if $!appname == 'dockerd' then {
    if ($programname == 'octoprint' and $msg contains 'Failed login attempt') or
       ($programname == 'caddy' and $msg contains 'Basic auth error 401') then {
      action(type="omfwd"
             target="192.168.0.100"
             port="514"
             protocol="tcp"
             template="OctoprintTemplate"
             queue.type="linkedList"
             queue.filename="octoprint"
             queue.maxdiskspace="1g"
             queue.saveonshutdown="on"
             action.resumeRetryCount="-1"
      )
  }
}

remote-log.conf

# /etc/rsyslog.d/remote-log.conf on server

$template host-prog-logs, "/var/log/remotes/%HOSTNAME%/%PROGRAMNAME%.log"
$template host-logs, "/var/log/remotes/%HOSTNAME%/syslog"

if ($hostname == ['HOST1', 'HOST2']) then {
    if ($programname == ['octoprint', 'homeassistant']) then {
        -?host-prog-logs
    } else {
        -?host-logs
    }
    stop
}

rsyslog

# add to /etc/logrotate.d/rsyslog

/var/log/remotes/*.log
/var/log/remotes/**/*.log

rsyslog.conf

# enable trusted properties in /etc/rsyslog.conf
# 

module(load="imuxsock"
       SysSock.Annotate="on"
       SysSock.ParseTrusted="on")