if $programname startswith "waf" then /var/log/waf.log
& stop