Hi David,
I don’t have the env to test right now, but can you try “$SYS/LOG/#” and see?
And you can also go check in the broker itself like the screenshot below to see what is the subscription that your fluentd client has, so you can check if the string is correctly captured or it was mistaken as a env var.