Filter.md

Filter Codec

The filter codec strips out unwanted events, shipping only those desired.

Table of Contents generated with DocToc

• Example
• Options
  • "negate"
  • "patterns"

Example

{
	"name": "filter",
	"patterns": [ "^(.*connect from.*)$", "^(.*status=sent.*)$" ]
}

Options

"negate"

Boolean. Optional. Default: false

Negates patterns so that an event is only shipped if none of the patterns matched.

"patterns"

Array of Strings. Required

A set of regular expressions to match against each line.

These are applied in the order that they are specified. As soon as a matching pattern is found the event is shipped and the remaining patterns are skipped until the next event. As such, patterns with higher hit rates should be specified first.

The pattern syntax is detailed at https://code.google.com/p/re2/wiki/Syntax.