[rsyslog] combining multiple filters

Hello, How can I filter messages that satisfy both conditions at the same time? :syslogtag, startswith, "dovecot"stop :msg, startswith, "imap-login " stop I am using rsyslog 8.1901.0-1 on Debian 10 thanks, ___ rsyslog mailing list

Re: [rsyslog] JSON extraction

I haven't tried this, but as an idea. Use mmnormalize/json twice: 1. parse the "upper" level, giving you msg 2. parse again, this time using msg as input Just an idea... Rainer El vie, 5 feb 2021 a las 0:49, John Chivian via rsyslog () escribió: > > David is correct. If what you posted is