Is there a maximum depth on recursive filter statements? I seem to have an issue which would indicate so. For example, in the config below, i have f_discard, which calls f_iptables_discard, which calls f_iptables. I have it like this so that its easy to read, configure, and add other filters. Its supposed to result in lines matching this to not be logged, but its not working. However if I take the contents of `f_iptables_discard` and put them directly into `f_discard` it works fine. filter f_iptables { program('^kernel') and message('^\s*\[\s*[\d\.]+\] iptables/' type(pcre)) }; filter f_iptables_discard { # ignore iptables broadcast messages filter(f_iptables) and message('MAC=ff:ff:ff:ff:ff:ff') ; }; filter f_discard { not ( filter(f_iptables_discard) ); }; rewrite r_tag { set('iptables', value('DBTAG') condition(filter(f_iptables))); }; log { source(s_local); source(s_net); rewrite(r_tag); filter(f_discard); destination(d_sqlite); };