/etc/rsyslog.conf:
  file.replace:
    - pattern: '#*.* @@remote-host:514'
    - repl: '*.* @@salt:514'
    - append_if_not_found: true

rsyslog:
  service.running:
    - enable: true
    - watch:
      - file: /etc/rsyslog.conf