if $programname == 'caravan' then /var/log/caravan.log
& stop