You can also use the flags(final) tag in your log statement to prevent matched logs from also being written to any log statements below it. Put it in your 'specifically filtered' log statement, defined *above* your 'main' log statement.

log {
source(s_all);
filter(f_specific_filter);
destination(d_specific_log);
flags(final);
}

log {
source(s_all);
destination(d_everything_else);
}

On Thu, Jan 21, 2010 at 12:58 PM, Siem Korteweg <Siem.Korteweg@qnh.nl> wrote:
Paul,

use the keyword "not" in your filter:

filter notmail { not facility(mail); }

regards,
Siem

-----Oorspronkelijk bericht-----
Van: syslog-ng-bounces@lists.balabit.hu namens PAUL WILLIAMSON
Verzonden: do 21-1-2010 21:48
Aan: syslog-ng@lists.balabit.hu
Onderwerp: [syslog-ng] Log all msgs but a specific filter

I need to log all messages except for a specific filter.  I have the filter
defined
and these messages are getting logged to a separate file.  However, I have
one
"main" log file where I do all my other processing.  How can I include that
filter in my destination so that it drops those specific messages from
getting
logged?

Thanks,
Paul

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email
______________________________________________________________________

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html





--
Lance Laursen
Demonware Systems Engineer