monline

In Debian the default /etc/rsyslog.conf includes all *.conf files from /etc/rsyslog.d. The contents of these config files are read by rsyslogd before the default rules, so you easily override any defaults.

Eg. to save all messages starting with "iptables: " into /var/log/iptables.log, you can create a /etc/rsyslog.d/iptables.conf with the following contents:

Yes, these are two lines.
If the above doesn't work for you, chances are that the message body contains has something else at the message start besides the "iptables: " prefix (that you might have used in all of your iptables rules). To debug the issue, use contains instead of startswith and use a template to mark the boundaries of the various log line segments.
Eg.

Eg. on a default Debian Squeeze system the above template generates log entries like this:

The above log was the result of an iptables rule with a --log-prefix "iptables: " option. However the kernel has put the "[1766537.526785] " string before our prefix. To compensate for it, you can use the contains compare operation:

Or you can use a (basic) regular expression: