NXLog Legacy Documentation

Filter (pm_filter)

This is a simple module that forwards logs if the specified condition is met.

This module is being phased out and will be removed in a future release. Use the drop() procedure with a conditional statement instead.

Example 1. Filtering Events With drop()

This statement drops the current event if the $raw_event field matches the specified regular expression.

if $raw_event =~ /^Debug/ drop();

To examine the supported platforms, see the list of installer packages in the Available Modules chapter.

Configuration

The pm_filter module accepts the following directives in addition to the common module directives.

Condition: This mandatory directive takes an expression as argument which must evaluate to a boolean value. If the expression does not evaluate to TRUE, the log message is discarded.

Examples

Example 2. Filtering Messages

This configuration retains only log messages that match one of the regular expressions, all others are discarded.

nxlog.conf

<Input uds>
    Module      im_uds
    UDS         /dev/log
</Input>

<Processor filter>
    Module      pm_filter
    Condition   $raw_event =~ /failed/ or $raw_event =~ /error/
</Processor>

<Output file>
    Module      om_file
    File        "/var/log/error"
</Output>

<Route uds_to_file>
    Path        uds => filter => file
</Route>