Kiwi Syslog Server NG: Multiple values in an Exclude complex filter are not applied as expected

Multiple values entered in an Exclude complex filter may not be excluded as expected. The behavior can affect the IP Address, Message Text, and Hostname fields.

KSS NG 1.5 fixed the multiple-value issue when Substring search was enabled. The remaining multiple-value Exclude behavior was fixed in KSS NG 2026.2.

1. Upgrade Kiwi Syslog Server NG to version 2026.2 or later.

2. Open Setup > Rules.

3. Select the affected rule and click Edit.

4. Open the complex filter and select the applicable field:

   • IP Address
   • Message Text
   • Hostname

5. Enter the values on the Exclude line, separated by commas. Multiple values on the same line are evaluated as alternatives.

6. Apply or save the rule.

7. Test the rule with messages containing each excluded value to confirm that the messages are filtered as expected.

NOTE: If upgrading is not possible, enable Substring search on the Exclude filter as a workaround. Substring search matches a value when it appears anywhere in the message.

Additional Notes

• On KSS NG 2026.2 and later, multiple values in an Exclude complex filter are supported without requiring Substring search.
• Filters on the same line use OR logic. Conditions entered on the And line are evaluated in addition to the Exclude values.