To create a filter that excludes multiple hosts in Syslog-ng PE, use the `not` operator in combination with the `host()` filter function and boolean logic. The `not` operator is used to invert the result of a filter expression. When it is necesarry to exclude multiple hosts, you can combine the `host()` filter functions with the `or` operator inside the parentheses, and then use `not` to invert the result.
Here is an example of how to create a filter that excludes messages from both `host1` and `host2`:
filter demo_filter { not (host("host1") or host("host2")); };