I'm sending /var/log/messages with rsyslog to remote log server with this syntax

```
*.* @remote_server_ip:port

```

in /var/log/messages there lines as;

```
06-03-2021  11:26:50    System0.Info    10.0.0.124  Jun  3 11:26:50 neptun04 HDB_SYSTEMDB[2049]: 2021-06-03T11:26:50.093414Z;nameserver;server_name;EHP;00;30001;SYSTEMDB;server_ip;pordevdb;28522;62678;Session_Management;INFO;CONNECT;SYSTEM;;;;;;SYSTEM;SUCCESSFUL;;;;;;;;162347;unknown;;;;;SYSTEM;HANACockpit;SYSTEM;;;;;;;;;;;;;;

```

I want to send only those lines insted of all messages to remote rsyslog.

I've tried to add below line to /etc/rsyslog.conf to seperate lines starts with "HDB\_SYSTEMD" to another log file (i thought if i can seperate i can send that log file only) but didn't work, it's not writing anything to hanna.log file;

```
*.*;mail.none;news.none                 -/var/log/messages
:msg, contains, "HDB_SYSTEMDB"          /var/log/hanna.log

```

How i can send specific lines to remote syslog server which contains "HDB\_SYSTEMD"