filter

Removes events, based on some given conditions

Field Name	Description	Type	Default
schema	Accept events that contain only given fields	array of fields	-
condition	Accept events only if given expression is true	string	-
patterns	Patterns that must match the field values for the event to go through	array of (field,regex) pairs	-
exclude	Patterns that must not match for the event to go through	array of (field,regex) pairs	-

schema

Accept events that contain only given fields

This removes any fields that are not listed!

Type: array of fields

Example

input:

{"first-name":"John"}
{"first-name":"Jane"}
{"last-name":"Doe"}

action:

filter:
  schema:
  - last-name

output:

{"last-name":"Doe"}

Example

input:

{"num":1,"text":"one"}
{"num":2,"text":"two","comment":"is even"}
{"num":3,"text":"three"}

action:

filter:
  schema:
  - num
  - comment

output:

{"num":2,"comment":"is even"}

condition

Accept events only if given expression is true

The expression is Lua. If the field might not exist, guard against warnings like so: num and num > 2

Type: string

Example

input:

{"first_name":"John"}
{"first_name":"Jane"}

action:

filter:
  condition: first_name == "Jane"

output:

{"first_name":"Jane"}

Example

input:

{"num":1,"text":"one"}
{"num":2,"text":"two","comment":"is even"}
{"num":3,"text":"three"}

action:

filter:
  condition: num > 2

output:

{"num":3,"text":"three"}

patterns

Patterns that must match the field values for the event to go through

Type: array of (field,regex) pairs

Example

input:

{"name":"John Doe"}
{"name":"Jane Doe"}

action:

filter:
  patterns:
  - name: Jane

output:

{"name":"Jane Doe"}

Example

input:

{"name":"John Doe"}
{"name":"Jane Doe"}

action:

filter:
  patterns:
  - name: ^Ja

output:

{"name":"Jane Doe"}

exclude

Patterns that must not match for the event to go through

Type: array of (field,regex) pairs

Example

input:

{"name":"John Doe"}
{"name":"Jane Doe"}

action:

filter:
  exclude:
  - name: Jane

output:

{"name":"John Doe"}

Example

input:

{"name":"John Doe"}
{"name":"Jane Doe"}

action:

filter:
  exclude:
  - name: ^Ja

output:

{"name":"John Doe"}