A defect has been found in version 7.0.28 of Syslog-ng PE where "NOT" filter statements are not being evaluated by Syslog-ng PE causing invalid results.
When a filter containing a "not" operator is reused in the config or a non-trivial filter containing "not" is referenced by its name within other filters could cause invalid results.
Product Defect: SYSLOGDEV-6244
Version 7.0.29 of Syslog-ng PE has addressed this defect and resolved this issue.
Please upgrade to 7.0.29 or the next latest version of Syslog-ng PE to resolve this issue.