NXLog User Guide

110.4. Filter (pm_filter)

This is a simple module which forwards log messages if the specified condition is TRUE.

Note	This module has been deprecated and will be removed in a future release. Filtering is now possible in any module with a conditional drop() procedure in an Exec block or directive.

Example 586. Filtering Events With drop()

This statement drops the current event if the $raw_event field matches the specified regular expression.


  1

  if $raw_event =~ /^Debug/ drop();

110.4.1. Configuration

The pm_filter module accepts the following directives in addition to the common module directives.

Condition: This mandatory directive takes an expression as argument which must evaluate to a boolean value. If the expression does not evaluate to TRUE, the log message is discarded.

110.4.2. Examples

Example 587. Filtering Messages

This configuration retains only log messages that match one of the regular expressions, all others are discarded.

nxlog.conf


  1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

  <Input uds>
    Module      im_uds
    UDS         /dev/log
</Input>

<Processor filter>
    Module      pm_filter
    Condition   $raw_event =~ /failed/ or $raw_event =~ /error/
</Processor>

<Output file>
    Module      om_file
    File        "/var/log/error"
</Output>

<Route uds_to_file>
    Path        uds => filter => file
</Route>