It seems as if your regex matches entire lines really - is that to say Shorewall loglines are mixed into log files, along with various other output?

You can certainly set up the content to be matched using a variable from an external file, but first it might be really useful to get the logs in order carefully.

If they are mixed logs, it's much more (needless) work.. better separate them out - e.g. each virtual site has its own logs, iptables logs to one file, auth events to another, etc etc

Sorry if I misunderstood what you're trying to acheive..