Logstash and syslog: logs from specific IP

They are different types of filters.

So if you put a search into KB, what happens?