filter

Removes events, based on some given conditions

filter patterns

Patterns that must match the field values for the event to go through

Type: array of (field,regex) pairs

Example

input:

{"name":"John Doe"}
{"name":"Jane Doe"}

action:

filter:
  patterns:
  - name: Jane

output:

{"name":"Jane Doe"}

Example

input:

{"name":"John Doe"}
{"name":"Jane Doe"}

action:

filter:
  patterns:
  - name: ^Ja

output:

{"name":"Jane Doe"}

filter exclude

Patterns that must not match for the event to go through

Type: array of (field,regex) pairs

Example

input:

{"name":"John Doe"}
{"name":"Jane Doe"}

action:

filter:
  exclude:
  - name: Jane

output:

{"name":"John Doe"}

Example

input:

{"name":"John Doe"}
{"name":"Jane Doe"}

action:

filter:
  exclude:
  - name: ^Ja

output:

{"name":"John Doe"}

filter schema

Accept events that contain only given fields

This removes any fields that are not listed!

Type: array of fields

Example

input:

{"first-name":"John"}
{"first-name":"Jane"}
{"last-name":"Doe"}

action:

filter:
  schema:
  - last-name

output:

{"last-name":"Doe"}

Example

input:

{"num":1,"text":"one"}
{"num":2,"text":"two","comment":"is even"}
{"num":3,"text":"three"}

action:

filter:
  schema:
  - num
  - comment

output:

{"num":2,"comment":"is even"}

filter condition

Accept events only if given expression is true

The expression is Lua

Type: string

Example

input:

{"first_name":"John"}
{"first_name":"Jane"}

action:

filter:
  condition: first_name == "Jane"

output:

{"first_name":"Jane"}

Example

input:

{"num":1,"text":"one"}
{"num":2,"text":"two","comment":"is even"}
{"num":3,"text":"three"}

action:

filter:
  condition: num > 2

output:

{"num":3,"text":"three"}