Filter

Filter (filter)

Only let certain events pass through.

Transform json

Minimal example

actions:
  - filter:
      how:
        schema: []

JSON

{
  "actions": [
    {
      "filter": {
        "how": {
          "schema": []
        }
      }
    }
  ]
}

Contents

• Minimal example

• Fields

• Schema

Fields

Field	Type	Required	Description
how	How	✅	The four ways to filter events: by schema, by patterns matching, by patterns not matching, or if empty.
description	string		describe this step.
condition	string		Only filter if this condition is true.
discard-until	boolean (bool)		if true, then we will discard events until the filter is green Thereafter, we pass all events through.

Schema

• How Options
• How - Patterns Table
• How - Exclude Table

How Options

Option	Name	Type	Description
schema	Schema	string[]	Accept events that contain only given fields; only lets these fields through.
patterns	Patterns	map	Patterns that must match the field values for the event to go through.
exclude	Exclude	map	Patterns that must not match for the event to go through.
empty	Empty	bool	Drop all empty events (events with no fields, empty arrays, or empty strings).
expression	Expression	string	Filter using an expression.

How - Patterns Table

Field	Regex
event.field	^value$

Key format: field. Value format: regex.

How - Exclude Table

Field	Regex
event.field	^value$

Key format: field. Value format: regex.