You could have the log shipper filter events and create a separate audit stream with different behavior and destination.

Really, have sane log message types and include ”audit” as one of them.

Log levels could be considered an anti-pattern.