logstash/logstash — pull request #600 by nhuff (2013-08-27 13:56:57+00:00)
Title: Add negate_expression option to grep filter

This options allows you to negate the original match in whole and not the individual components. This is useful if you want to reject events that match all of several components. In my case I want to discard events from a certain syslog program that has DEBUG in the message, but keep all the other messages from that program. This is hard to do with current negate option.

As a sort of plus if you set both negate and negate expression to true you can get OR matching of your components instead of AND.