lindberg16 - The way I run my network is that I use a Configuration Template to remove all Logging servers and then re-configure the ones I want. Then I go to different devices and copy-paste the logging I want into a notepad doc. I use .*\n to go from line to line and list exactly what I do want. Then at the bottom I have an "and must not contain" additional logging servers listed. I do not use IP's on the last line as the right ones are listed above.
You can download from Configs Tab > Compliance > Manage Reports > Shared on Thwack several different rules and examples to help you on your way.