It seems that I have problem filtering only syslog from pfsense ( 2.4.4-RELEASE-p3 (amd64)
built on Wed May 15 18:53:44 EDT 2019 FreeBSD 11.2-RELEASE-p10) which is sending only openvpn logs to syslog-ng on librenms server.
After more investigation it seems that this problem shows only on syslogs which have more millions entries, it sounds like time out happens then it returns No results found!
Solution is to put content from Syslog - LibreNMS Docs to /etc/syslog-ng/syslog-ng.conf and service syslog-ng restart and after that it is filtering fine.