Log ingest rules