As documented, the logical disjunction operator is `or` and not `||`.

https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html

Secondly, each side of the disjunction must be a complete expression, i.e. `[host] =~ /.../ or [host] =~ /.../`, not `[host] =~ /.../ or /.../`.

Finally, you should look into the cidr filter.

---
NEW: Monitor These Apps!
elasticsearch, apache solr, apache hbase, hadoop, redis, casssandra, amazon cloudwatch, mysql, memcached, apache kafka, apache zookeeper, apache storm, ubuntu, centOS, red hat, debian, puppet labs, java, senseiDB