NXLog Legacy Documentation

Filter (pm_filter)

This is a simple module which forwards log messages if the specified condition is TRUE.

This module has been deprecated and will be removed in a future release. Filtering is now possible in any module with a conditional drop() procedure in an Exec block or directive.

Example 1. Filtering Events With drop()

This statement drops the current event if the $raw_event field matches the specified regular expression.

if $raw_event =~ /^Debug/ drop();

To examine the supported platforms, see the list of installer packages in the Available Modules chapter.

Configuration

The pm_filter module accepts the following directives in addition to the common module directives.

Condition: This mandatory directive takes an expression as argument which must evaluate to a boolean value. If the expression does not evaluate to TRUE, the log message is discarded.

Examples

Example 2. Filtering Messages

This configuration retains only log messages that match one of the regular expressions, all others are discarded.

nxlog.conf

<Input uds>
    Module      im_uds
    UDS         /dev/log
</Input>

<Processor filter>
    Module      pm_filter
    Condition   $raw_event =~ /failed/ or $raw_event =~ /error/
</Processor>

<Output file>
    Module      om_file
    File        "/var/log/error"
</Output>

<Route uds_to_file>
    Path        uds => filter => file
</Route>