[rsyslog] Expression based filters not working?

[Phillip Heller]

Hello,

  Running 3.19.9 with the following old style config bits:

:msg, contains, "%ASA-" -?DailyLogs;pix_format
:msg, contains, "%VOIPAAA" -?DailyCDR
:msg, !contains, "%VOIPAAA" -?DailyLogs

This works just fine, though the messages from the ASA are output to  
the DailyLogs template twice.  I have not seen an example how one  
might use a logical AND with the old style config.

So, I've tried the new expression style config:

if $msg contains '%ASA-' then -?DailyLogs;pixformat
if $msg contains 'VOIPAAA' then -?DailyCDR
if $msg !contains '%VOIPAAA' and $msg !contains '%ASA-' then -?DailyLogs

However, this style seems to not work at all.  That is, no messages  
are recorded to DailyLogs or DailyCDR.

Any suggestions?

Regards,

  Phil