Thanks for the fast response.
This might be a dumb question but, I saw the syslog forward action before and it's asking for a hostname or IP address. Where would I forward it too? The syslog message is already being sent to our syslog server. Why would I forward the syslog again to the same syslog server? Maybe I'm not understanding lol.