This is a simple module which forwards log messages if the specified condition is TRUE.
|This module has been deprecated and will be removed in a future release. Filtering is now possible in any module with a conditional drop() procedure in an Exec block or directive.|
This statement drops the current event if the
$raw_event field matches the
specified regular expression.
1 if $raw_event =~ /^Debug/ drop();
The pm_filter module accepts the following directives in addition to the common module directives.
This mandatory directive takes an expression as argument which must evaluate to a boolean value. If the expression does not evaluate to TRUE, the log message is discarded.
This configuration retains only log messages that match one of the regular expressions, all others are discarded.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 <Input uds> Module im_uds UDS /dev/log </Input> <Processor filter> Module pm_filter Condition $raw_event =~ /failed/ or $raw_event =~ /error/ </Processor> <Output file> Module om_file File "/var/log/error" </Output> <Route uds_to_file> Path uds => filter => file </Route>