Payload keyword to specific nodes

Hi, I am trying to write an irule that will look for words in syslog payload and direct traffic to an IP address and port based on the keyword but also send an untouched copy to another IP Address. So basically send "ABC" to 1.1.1.1:9000 and send "XYZ" 1.1.1.1:9001 but send bot ABC and XYZ to node 2.2.2.2:515. It will split off the ABC and send to node 1.1.1.1:9000 but wont send anything to XYZ.

 

when CLIENT_ACCEPTED {

 

if { [UDP::payload] contains "ABC" } { node 1.1.1.1:9000 } elseif { [UDP::payload] contains "XYZ" } { node 1.1.1.1:9001 } else { node 2.2.2.2:514 } }