I'm trying to dynamically create lognames and directories form the host name that is sent. My hosts' names are of the form foo_<mac address> I want to create a destination that would be /logs/foo_<first 9 digits of mac address>/<date>/foo_<mac_address>.log Here is what I tried so far, and it does not work, but is close. Can someone suggest a config that might work? Thx. I can do this individually, but having 100+ filters and 100+ log lines in the config really slows things down. #filter for foo filter foo_filter { match('host("foo_[0-9A-F]\{9\}$")' flags("store-matches")); }; # foo destinations destination foo_dest { file("/logs/$0/$R_YEAR$R_MONTH$R_DAY/$HOST-$R_YEAR$R_MONTH$R_DAY.log" owner(root) group(root) perm(0444) template("$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC $MSG\n") template_escape(no)); };