body common control
{
    bundlesequence      =>  {
                            test,                  # test.cf
                        };

    syslog_host           => "$(sys.policy_hub)";
    syslog_port           => "5308";
    version               => "[promises $Rev$ $(sys.cf_version)]";
}

bundle agent test
{

 vars:

  "logdict[class_1]" string => "this is class_1 message";
  "logdict[class_2]" string => "this is class_2 message";
  "logdict[len]" int => "2";
  "prefixclass"      string => "any";
  "keys" slist => { getindices(logdict) };

  methods:

    "$(keys)"
      usebundle   => sendToLoghost("$(this.bundle)", "Beautiful horse !!", "$(keys)", "test.logdict"),
      ifvarclass  => "$(prefixclass)";
}

bundle agent sendToLoghost(p, b, c, l)
{
meta:

  "p" string => "the prefix : aka service name";
  "b" string => "calling bundle";
  "c" string => "raised class known in the log catalog 's' wich triggered this bundle";
  "l" string => "log catalog";

defaults:

  "b"
    string          => "W : insult detected in the name of the calling bundle",
    if_match_regex  => ".*horse.*";

files:

  "$(sys.workdir)/outputs/logger"
    create => "true",
           handle => "u_send_to_loghost_fake_file_action",
           action => u_immediate_syslog("[hstl] [$(p)] [$($(l)[len])] [$(b)] [$($(l)[$(c)])]");
}
body action u_immediate_syslog(x)
{
  log_repaired => "udp_syslog";
  log_kept     => "udp_syslog";
  log_failed   => "udp_syslog";
  log_string   => "$(x)";
  ifelapsed    => "0";
}

On the policy_hub :

Feb 28 18:17:51 nodexx [hstl] [test] [2] [W : insult detected in the name of the calling bundle] [this is class_1 message]
Feb 28 18:17:51 nodexx [hstl] [test] [2] [W : insult detected in the name of the calling bundle] [this is class_2 message]
Feb 28 18:17:51 nodexx [hstl] [test] [2] [W : insult detected in the name of the calling bundle] [2]