LOG IGNORE matching

I may still not be understanding how the pattern matching is done for the LOG keyword.

I have:

    LOG /var/adm/messages %(?-i)auth.error COLOR=yellow

IGNORE="%(?-i)sshd|flavor_basic: (null)"

Which I think should mean: look for the string "auth.error" in /var/adm/messages and then ignore lines with "sshd" OR "flavor_basic: (null)" in them.

If I *only* have IGNORE=sshd that seems to work, but I really need to ignore both (at least for my testing), but when I do it as above, I get yellow screens for auth.error lines even if they have the string "sshd" in them.

Am I missing something?

BTW, in BB I have a very long list of strings to ignore. Is there an easier way to do that in hobbit other than to put each string into an IGNORE clause?

Thanks, Steve Holmes