$ModLoad ommail
$ActionMailSMTPServer mydomain.com
$ActionMailFrom example@mydomain.com
$ActionMailTo example@gmail.com
$template mailSubject,"User logged into %hostname%"
$template mailBody,"RSYSLOG Alertrnmsg='%msg%'"
$ActionMailSubject mailSubject
$ActionExecOnlyOnceEveryInterval 60
if $msg contains 'session opened for user' then :ommail:;mailBody

if $msg contains 'Accepted password for' then :ommail:;mailBody