[ossec-list] filter rules on host and log file?

["metacosmic@xxxxxxxxx" <metacosmic@xxxxxxxxx>]

hi *,

i run ossec agent on several web servers where i monitor the system
files and the webserver log files.
now i ran into a problem with the rule

Rule: 1002 fired (level 7) -> "Unknown problem somewhere in the
system."

this rules (is my understanding) is just a pattern matching of bad
words or?
and here starts my problem ;)

there might be session id in the webserver logfiles wich includes the
three letters bad ...
there might be a valid html slide with the name terrorist
there might be a valid html slide with the name errorxyz ...

all this stuf fires up the rules 1002 :)

therefor i don´t want to apply the rules to the webserver log files
but of curse to the system log files on this host ...
i don't have the slightest idea of howto manage this with rules
section :)

ideas very welcome!

cheers
philipp