That works VERY well and is exactly what I was hoping to accomplish! Hooray!
Seems to even catch multiple bad servers sprinkled about the list of logging hosts.
Looks like making it a non-capture groups was extremely important and something I had not tried in my earlier flailing around with regex. I had been playing around with the negative lookaheads but never got it to work right/reliably.
It even makes me pretty confident that the remediation script probably won't mess with me. If I do shoot myself in the foot, I promise not to blame you. Only so much damage I can cause with logging servers .
This will be a handy rule to copy for all those other, similar, instances!
Thanks! That is quite helpful.