SSH Version:

OpenSSH_8.0p1, OpenSSL 1.1.1k  FIPS 25 Mar 2021

sshd_config:

SyslogFacility LOCAL5
#LogLevel INFO

Subsystem sftp internal-sftp -l INFO
Match Group sftp
ChrootDirectory /sftp/hs
ForceCommand internal-sftp -l INFO
AllowTcpForwarding no
X11Forwarding no

rsyslog.conf

authpriv.*            /var/log/secure
local5.*              /var/log/sftp.log

In those settings, my sshd and sftp log are both in /var/log/sftp.log, but I want that regular sshd logs write into /var/log/secure, and sftp logs into /var/log/sftp.log.

How can I spilt it whth sshd and rsyslog

I tried use Subsystem sftp internal-sftp -l INFO -f LOCAL4 to a different log facility, but it does not work, only the setting SyslogFacility LOCAL5 is work.