Filter

Filter (filter)

Only let certain events pass through.

Transform json

Minimal example

actions:
  - filter:
      how:
        schema: []

JSON

{
  "actions": [
    {
      "filter": {
        "how": {
          "schema": []
        }
      }
    }
  ]
}

Contents

• Minimal example

• Fields

• Schema

A ✓ marks a field that accepts a context variable such as {{ VARIABLE }}.

Fields

Field	Type	Required	Description
description	string		describe this step.
condition	string		Only filter if this condition is true. The expression is Lua. If the field might not exist, guard against warnings
like so: num and num > 2
discard-until ✓	boolean (bool)		if true, then we will discard events until the filter is green Thereafter, we pass all events through. Default: false
how	How	✅	The four ways to filter events: by schema, by patterns matching, by patterns not matching, or if empty. Allowed values: schema, patterns, exclude, empty, expression

Schema

• How Options
• How - Patterns Table
• How - Exclude Table

How Options

Option	Name	Type	Description
schema	Schema	string[]	Accept events that contain only given fields; only lets these fields through.
patterns	Patterns	map	Patterns that must match the field values for the event to go through.
exclude	Exclude	map	Patterns that must not match for the event to go through.
empty	Empty	bool	Drop all empty events (events with no fields, empty arrays, or empty strings). Default: false
expression	Expression	string	Filter using an expression.

How - Patterns Table

Field	Regex
event.field	^value$

Key format: field. Value format: regex.

How - Exclude Table

Field	Regex
event.field	^value$

Key format: field. Value format: regex.