From OSSEC Wiki

How to add multiple log files to be monitored?

• By Daniel B. Cid

If you have multiple log files to be monitored by OSSEC and don't
want to add each one of them manually, you can configure them using
posix regular expressions.

For example, if you have a directory structure like this:

/var/log/host1/xx.log, yy.log, zz.log
/var/log/host2/xx.log, aa.log
/var/log/host3/zz.log, abc.log
/var/log/hostn/bb.log, xyz.log

You can just add one entry in the localfile to monitor all these logs:

<localfile>
 <log_format>syslog</log_format>
 <location>/var/log/host*/*.log</location>
</localfile>

This tip can make large configurations much simpler.