@shoothub Not really, it’s something that is present in the two field messages of the logs I want to filter. My goal here is to say "all logs that come from Serveur03 and that have “key=” or “cwd=” in the field messages go into the stream “Syslog commands logs”.