Yes it's on Syslog server side and you're right, I misunderstood the fonction of invert="1", that's not what I need.
When I match in a rule, I send an email (for ex <Match>(.*)Error(.*)</match)->event->EPP->mail contains syslog message).
But there is messages that contains "Error" and reveals useless (like error user connection or something...)
Maybe it's not possible to do that but there is what I want:
if ("abc" && NOT "XYZ") => Match (I mean send email)
if ("abc" && "XYZ") => don't Match (don't send mail)
Of course the test will apply on the same message text, in fact, I would like to seprate "Error connection ... person1" and "Error connection... person2"
Thanks a lot.