There's quite a lot going on here. filter fs_pollingsysthermal { match("scemd: polling_sys_thermal\.c:35 ioctl device failed" value("MESSAGE")); }; filter fs_pollingsysvoltage { match("scemd: polling_sys_voltage\.c:35 ioctl device failed" value("MESSAGE")); }; filter fs_pollingfanspeedrpm { match("scemd: polling_fan_speed_rpm\.c:35 ioctl device failed" value("MESSAGE")); }; The matches won't work as "scemd:" isn't present in the source data; it gets added by syslog-ng along with the times