Boolean operators in FilterX

When a log statement includes multiple filter statements, AxoSyslog sends a message to the destination only if all filters are true for the message. In other words, the filters are connected by logical AND operators. In the following example, no message arrives to the destination, because the filters are mutually exclusive (the hostname of a client cannot be example1 and example2 at the same time):

log {
    source(s1); source(s2);
    filterx { ${HOST} == "example1"; };
    filterx { ${HOST} == "example2"; };
    destination(d1); destination(d2); };

To select the messages that come from either host example1 or example2, use a single filter expression:

log {
    source(s1); source(s2);
    filterx { ${HOST} == "example1" or ${HOST} == "example2"; };
    destination(d1); destination(d2); };

Use the not operator to invert boolean filters, for example, to select messages that weren’t sent by host example1:

filterx { not ( ${HOST} == "example1" ); };

However, to select the messages that weren’t sent by host example1 or example2, you have to use the and operator (that’s how boolean logic works, see De Morgan’s laws for details):

filterx { not (${HOST} == "example1") and not (${HOST} == "example2"); };

Alternatively, you can use parentheses and the or operator to avoid this confusion:

filterx { not ( (${HOST} == "example1") or (${HOST} == "example2") ); };

The following filter statement selects the messages that contain the word deny and come from the host example.

filterx {
    ${HOST} == "example";
    ${MESSAGE} =~ "deny";
};