if $syslogfacility-text == "user" then /var/log/app
if $syslogfacility-text == "user" and ( $syslogseverity-text >= "warn") then /dev/console