If there are multiple source or host stanzas that match a given event, the order in which settings are applied also comes into play. A stanza with a pattern has a priority of 0, while an exact stanza has a priority of 100. Higher priorities win. For instance, say we have the following stanza:
[source::/logs/abc/def/gh.log] TZ = UTC [source::/logs/.../*.log] TZ = CDT
Our TZ value will be UTC since the exact match of source::/logs/abc/def/gh.log has a higher priority.
When priorities are identical, stanzas are applied by the ASCII order. For instance, say we have this configuration snippet:
[source::/logs/abc/.../*.log] TZ = MST [source::/logs/.../*.log] TZ = CDT
The attribute TZ=CDT will win because /logs/.../*.log ...
