This article provides information on the matching  condition for logging in [system syslog] configuration. 

The feature does not work when it is configured in (Stream Mode) but it will  work when it is configured in  (Event mode) this is per design and expected behavior.

This is an Example show the configuration that triggers this expected behavior , of [system syslog] configuration , Stream and Event mode.

For example , match condition (match "!RT_FLOW_SESSION") was working with event mode and not with stream mode i.e. ( 10.0.0.2 is the syslog server) : 
 

• Event mode

• Stream mode

This is an expected and also  per design behavior.

The Routing engine puts the match condition and filters the log, when we use stream mode the traffic is streamed out of the data plane itself in high end devices, and does not  reach the RE, therefore the match condition dose not work when using stream mode and only works in event mode.


SRX high-end device Full Config example :
 

system {
    root-authentication {
        encrypted-password "$ABC123"; ## SECRET-DATA
    }
    syslog {
        host 10.0.0.2 {
            any any;
            match "!RT_FLOW_SESSION";
        }
    }
}

interfaces {
    ge-0/0/1 {
        unit 0 {
            family inet {
                address 10.0.0.1/24;
            }
        }
    }
    ge-0/0/4 {
        unit 0 {
            family inet {
                address 192.168.0.2/24;
            }
        }
    }
}

security {
    log {
        mode stream;
        format sd-syslog;
        source-address 10.0.0.1;
        stream securitylog {
            format syslog;
            category all;
            host {
                10.0.0.2;
            }
        }
    }
    zones {
        security-zone one {
            interfaces {
                ge-0/0/4.0 {
                    host-inbound-traffic {
                        system-services {
                            all;
                        }
                    }
                }
            }
    }
    security-zone two {
        interfaces {
            ge-0/0/1.0 {
                host-inbound-traffic {
                    system-services {
                        all;
                    }
                }
            }
       }
    }
}

policies {
    from-zone one to-zone two {
        policy 1 {
            match {
                source-address any;
                destination-address any;
                application any;
            }
        then {
            permit;
            log {
                session-init;
                session-close;
            }
        }
        }
    }
    from-zone two to-zone one {
        policy 1 {
            match {
                source-address any;
                destination-address any;
                application any;
            }
        then {
            permit;
                log {
                    session-init;
                    session-close;
                }
        }
        }
    }
}
}