Thank you very much for your kind reply! It really works as you wrote :-) (with ^...$ RE). Now I have one another question. How can I filter out this kind of log record: datum hostX process some text with "xxxxx" string I want to write it in file for hostX.log, so I wrote filter: filter f_hostX { host("hostX"); }; then I wrote filter for string "xxxxx": filter f_notxxxxx { not match("xxxxx"); }; and then I used it all in log statement: log {... filter f_hostX ; filter f_notxxxxx ; ... } I tried to log something on host hostX with string "xxxxx", and I received it in syslog-ng in file hostX.log. Why ? What am I doing wrong now ? Please sorry if I missunderstand something, but I tried it more times with other combinations of filter, but the "NOT" statement simply does not work ... Thank you in advance for your reply... Bye, Lubos. __________________________________________________ Do You Yahoo!? Sign up for SBC Yahoo! Dial - First Month Free http://sbc.yahoo.com