How to add 2 separate filters to a single _raw splunk data in edge processor

[Rani2]

I have created a pipeline for filtering data coming into the sourcetype = fortigate_traffic.

I would like to further add an exclusion to the data coming into this sourcetype. How can this be done? Nested ? or any other method

eg;- 1st pipeline is

where NOT (dstport IN ("53") AND dstip IN ("10.5.5.5"))

Need to add onother pipeline as 

NOT (dstport IN ("80","443") AND (app IN (xyz,fgh,dhjkl,.....)

Has anyone done anything similar to this. Please guide.

Thanks 

[tej57]

Hey @Rani2,

I haven't tested it myself. But can you not combine two conditions using AND?

Thanks,
Tejas.