diff --git a/tasmota/tasmota_support/support.ino b/tasmota/tasmota_support/support.ino
index 9eef0b36a..3c2b7c36c 100755
--- a/tasmota/tasmota_support/support.ino
+++ b/tasmota/tasmota_support/support.ino
@@ -2469,6 +2469,11 @@ void SyslogAsync(bool refresh) {
            and below message in syslog if hostname starts with a "z"
          2023-12-17T00:09:52.797782+01:00 domus8 rsyslogd: Uncompression of a message failed with return code -3 - enable debug logging if you need further information. Message ignored. [v8.2302.0]
          Notice in both cases the date and time is taken from the syslog server
+
+         Example of rsyslog filter using rsyslog properties:
+         :programname, startswith, "ESP-" /var/log/udp-logs/esp.log  # Log in esp.log
+         :programname, startswith, "ESP-" stop                       # Do not log in syslog
+
       */
 //      snprintf_P(header, sizeof(header), PSTR("%s ESP-"), NetworkHostname());
 
@@ -2483,6 +2488,10 @@ void SyslogAsync(bool refresh) {
          LOG_LEVEL_INFO       2 -> severity level 6 - Informational
          LOG_LEVEL_DEBUG      3 -> severity level 7 - Debug
          LOG_LEVEL_DEBUG_MORE 4 -> severity level 7 - Debug
+
+         Example of rsyslog filter using rsyslog properties:
+         :programname, startswith, "ESP-" /var/log/udp-logs/esp.log  # Log in esp.log
+         :programname, startswith, "ESP-" stop                       # Do not log in syslog
       */
 //      snprintf_P(header, sizeof(header), PSTR("<%d>%s ESP-"), 128 + min(loglevel * 3, 7), NetworkHostname());
 
@@ -2493,6 +2502,10 @@ void SyslogAsync(bool refresh) {
          SYSLOG-MSG = <134>Jan  1 00:00:02 wemos5 ESP-HTP: Web server active on wemos5 with IP address 192.168.2.172
          Result = 2023-01-01T00:00:02+01:00 wemos5 ESP-HTP: Web server active on wemos5 with IP address 192.168.2.172
          Notice Year is taken from syslog server. Month, day and time is provided by Tasmota device. No milliseconds
+
+         Example of rsyslog filter using rsyslog properties:
+         :programname, startswith, "ESP-" /var/log/udp-logs/esp.log  # Log in esp.log
+         :programname, startswith, "ESP-" stop                       # Do not log in syslog
       */
 //      snprintf_P(header, sizeof(header), PSTR("<134>%s %s ESP-"), GetSyslogDate(line).c_str(), NetworkHostname());
 
@@ -2500,16 +2513,21 @@ void SyslogAsync(bool refresh) {
       uint32_t msg_len = len -mxtime -1;
 
       /* RFC5424 - Syslog protocol - <PRI>VERSION TIMESTAMP HOSTNAME APP_NAME PROCID STRUCTURED-DATA MSGID MSG
-         <PRI> = Facility 16 (= local use 0), Severity 6 (= informational) => 16 * 8 + 6 = <134>
-         VERSION = 1
+         <PRI>[5] = Facility 16 (= local use 0), Severity 6 (= informational) => 16 * 8 + 6 = <134>
+         VERSION[2] = 1
          TIMESTAMP = yyyy-mm-ddThh:mm:ss.nnnnnn-hh:mm (= local with timezone)
-         APP_NAME = tasmota
-         PROCID = -
+         HOSTNAME[255] = wemos5
+         APP_NAME[48] = tasmota
+         PROCID[128] = -
          STRUCTURED-DATA = -
-         MSGID = HTP:
-         SYSLOG-MSG = <134>1 1970-01-01T00:00:02.096000+01:00 wemos5 Tasmota - - ESP-HTP: Web server active on wemos5 with IP address 192.168.2.172
-         Result = 1970-01-01T00:00:02.096000+00:00 wemos5 Tasmota ESP-HTP: Web server active on wemos5 with IP address 192.168.2.172
+         MSGID[32] = HTP:
+         SYSLOG-MSG = <134>1 1970-01-01T00:00:02.096000+01:00 wemos5 tasmota - - HTP: Web server active on wemos5 with IP address 192.168.2.172
+         Result = 1970-01-01T00:00:02.096000+00:00 wemos5 tasmota HTP: Web server active on wemos5 with IP address 192.168.2.172
          Notice date and time is provided by Tasmota device.
+
+         Example of rsyslog filter using rsyslog properties:
+         :programname, isequal, "tasmota" /var/log/udp-logs/esp.log  # Log in esp.log
+         :programname, isequal, "tasmota" stop                       # Do not log in syslog
       */
       char timestamp[mxtime];
       subStr(timestamp, line, " ", 1);                        // 00:00:02.096-026
@@ -2520,19 +2538,29 @@ void SyslogAsync(bool refresh) {
         GetDate().c_str(), timestamp, GetTimeZone().c_str(),  // 1970-01-01T00:00:02.096000+01:00
         NetworkHostname());
 */
+/*
+      // msgid is currently not well supported in rsyslog (https://github.com/rsyslog/rsyslog/issues/3592#issuecomment-480186237)
       char msgid[5];
       char* line_msgid = strchr(msg_start, ' ');
-      if (line_msgid - msg_start < sizeof(msgid)) {           // Only 3 character message ids supported
+      if (line_msgid && (line_msgid - msg_start < sizeof(msgid))) {  // Only 3 character message ids supported
         subStr(msgid, msg_start, " ", 1);                     // HTP:
         msg_start += strlen(msgid);
         msg_len -= strlen(msgid);
       } else {
         strcpy(msgid, "-");                                   // -
       }
+*/
+      char msgid[2] = { 0 };
+      char* line_msgid = strchr(msg_start, ':');
+      if ((line_msgid == nullptr) || (line_msgid - msg_start != 3)) {  // Only 3 character message id supported
+        strcpy(msgid, "-");                                   // -
+      }
+
       snprintf_P(header, sizeof(header), PSTR("<%d>1 %s%s000%s %s tasmota - - %s"),
         128 + min(loglevel * 3, 7),                           // Error (1) = 131, Info (2) = 134, Debug (3) = 135, DebugMore = (4) 135
         GetDate().c_str(), timestamp, GetTimeZone().c_str(),  // 1970-01-01T00:00:02.096000+01:00
         NetworkHostname(), msgid);
+
 /*
       TasConsole.printf("Loglevel ");
       TasConsole.print(loglevel);