Hi,

Does a "and" and a "or" work together?

i.e.: filter f_myfilter { level(crit) and match("NOT OK") or match("terminated"); };

Would I get messages that are crit and contain "NOT OK", as well as crit and contain "terminated"

Try this: filter f_myfilter { level(crit) and ( match("NOT OK") or match("terminated") ) ; }; This way you can be sure that the "or" is evaluated first. I haven't tested it, but it should work. Greetings Gert