# /etc/rsyslog.d/log_nft.conf

# Log nftables INPUT_DROP Meldungen
:msg, contains, "INPUT_DROP:"   -/var/log/nft_in.log
& stop

# Log nftables FORWARD_DROP Meldungen
:msg, contains, "FORWARD_DROP:" -/var/log/nft_out.log
& stop