When a log statement includes multiple filter statements, syslog-ng sends a message to the destination only if all filters are true for the message. In other words, the filters are connected with the logical AND operator. In the following example, no message arrives to the destination, because the filters are exclusive (the hostname of a client cannot be example1 and example2 at the same time):

 filter demo_filter1 { host("example1"); };
 filter demo_filter2 { host("example2"); };
 log demo_filteredlog {
    source(s1); source(s2); 
    filter(demo_filter1); filter(demo_filter2);
    destination(d1); destination(d2); };

To select the messages that come from either host example1 or example2, use a single filter expression:

 filter demo_filter { host("example1") or host("example2"); };
 log demo_filteredlog {
    source(s1); source(s2); 
    filter(demo_filter);
    destination(d1); destination(d2); };

For more details, please check the documentation.