Too complex for tags?

[jedatt01]

I want to create a tag that involves two extracted fields and a combination of AND/OR statements, see example below.

key/value pair 1
(PolicySetName=policy1 AND (AuthPolicy=auth1 OR AuthPolicy=auth2 OR AuthPolicy=auth3))

key/value pair 2
(PolicySetName=policy2 AND AuthPolicy=auth4)

key/value pair 3
(PolicySetName=policy3 AND AuthPolicy=auth5)

Is this even possible with a tag?

[gcusello]

Set your tags starting from eventtypes creation, assigning a tag to an eventtype as you want complex, don't start from creating a new tags, you'll reach your target.
Bye.
Giuseppe

[gcusello]

if you're satisfied of the answer, please, accept the answer.
Bye.
Giuseppe