Hi, The reason I asked you to configure syslogng to index to "test" was to make sure you are in the same conditions as your curl command. You might for instance have a mapping template matching fw-* but not test. Please either configure syslogng to index to test, or use the same fw- index on the curl cmdline.