Skip to main content
Version: 3.4.0

filter

Removes events, based on some given conditions

Field NameDescriptionTypeDefault
schemaAccept events that contain only given fieldsarray of fields-
conditionAccept events only if given expression is truestring-
patternsPatterns that must match the field values for the event to go througharray of (field,regex) pairs-
excludePatterns that must not match for the event to go througharray of (field,regex) pairs-

schema

Accept events that contain only given fields

This removes any fields that are not listed!

Type: array of fields

Example

input:

{"first-name":"John"}
{"first-name":"Jane"}
{"last-name":"Doe"}

action:

filter:
schema:
- last-name

output:

{"last-name":"Doe"}

Example

input:

{"num":1,"text":"one"}
{"num":2,"text":"two","comment":"is even"}
{"num":3,"text":"three"}

action:

filter:
schema:
- num
- comment

output:

{"num":2,"comment":"is even"}

condition

Accept events only if given expression is true

The expression is Lua. If the field might not exist, guard against warnings like so: num and num > 2

Type: string

Example

input:

{"first_name":"John"}
{"first_name":"Jane"}

action:

filter:
condition: first_name == "Jane"

output:

{"first_name":"Jane"}

Example

input:

{"num":1,"text":"one"}
{"num":2,"text":"two","comment":"is even"}
{"num":3,"text":"three"}

action:

filter:
condition: num > 2

output:

{"num":3,"text":"three"}

patterns

Patterns that must match the field values for the event to go through

Type: array of (field,regex) pairs

Example

input:

{"name":"John Doe"}
{"name":"Jane Doe"}

action:

filter:
patterns:
- name: Jane

output:

{"name":"Jane Doe"}

Example

input:

{"name":"John Doe"}
{"name":"Jane Doe"}

action:

filter:
patterns:
- name: ^Ja

output:

{"name":"Jane Doe"}

exclude

Patterns that must not match for the event to go through

Type: array of (field,regex) pairs

Example

input:

{"name":"John Doe"}
{"name":"Jane Doe"}

action:

filter:
exclude:
- name: Jane

output:

{"name":"John Doe"}

Example

input:

{"name":"John Doe"}
{"name":"Jane Doe"}

action:

filter:
exclude:
- name: ^Ja

output:

{"name":"John Doe"}