Hi, 

Currently the selector must be a string or a macro, and its value must appear in the first field of the csv file. So you must either list every possible IP address in the csv file, or somehow add the netmask/subnet as a field to the message, and use that as the selector. 
For example, if you do not have too many separate vlans/subnets, you could try using conditional rewrites (https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/conditional-rewrite.html) to replace the filter and set a custom field. Something like: 

rewrite r_rewrite_set{set("43", value("MY_VLANID") condition(netmask(192.168.1.0/24)));};
...
add-contextual-data(
        selector($MY_VLANID)
        database(“/opt/syslog-ng/etc/VLAN_Descriptions.csv")
        default-selector("unknown-hostname")
        );
...
And the first field of the CSV must be the VLANID value.

HTH, 
Robert




On Wed, Oct 19, 2016 at 1:01 AM, Scot Needy <scotrn@gmail.com> wrote:
Tried adding this way and seems to be looking for the tag rather than adding.
Logging stopped for this filter.

filter f_192_168_1_0 {
        netmask(192.168.1.0/24);
        tags(“VMware_ESX");
        };


> On Oct 18, 2016, at 6:12 PM, Scot Needy <scotrn@gmail.com> wrote:
>
>
> Could I leverage this type of CSV to add VLAN ID and VLAN description tags if I already have
>
> filter f_192_168_1_0 { netmask(192.168.1.0/24);};
>
>
> VLAN_Descriptions.csv
> VLANID,       VLAN Description,       subnet/24
> 43,   Database_#14141,        192.168.1.1/24
>
> filter f_192_168_1_0 {
>       netmask(192.168.1.0/24);
>       add-contextual-data(
>       selector($IP is in f_192_168_1_0 or something specific?????/)
>       database(“/opt/syslog-ng/etc/VLAN_Descriptions.csv")
>       default-selector("unknown-hostname")
>       );
>
> };
>
>
>

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq