:msg, contains, "analytics" /var/log/analytics/analytics.log
&~