I wonder if constant work pattern would be a good choice for this setup. That is always send all the logs from logfwdr to logpush and only at this stage take all the data that was not actually requested by the client and send it to the local /dev/null.