fluent-plugin-filter¶ ↑

Filtering messages by simple allow/deny rules.

Add this line to your application’s Gemfile:

gem 'fluent-plugin-filter'

And then execute:

$ bundle

Or install it yourself as:

$ gem install fluent-plugin-filter

Filter out messages contains {status : 404} :

<match accesslog.**>
  type filter
  all allow
  deny status: 404
</match>
<match filtered.**>
  type stdout
</match>

in above configuration, {status: 404} is filtered out and {status: 200}, {status: 303}, {status: 401} passed. Messages passing filter are add_prefix (default filtered.)

So you catch “filtered” tag and do next process.

You can use int, float, string, regexp in value.

In fluentd >= 0.12, we can use ‘filter` declarative. So release Filter filter:

<filter accesslog.**>
  type filter
  all allow
  deny status: 404
</filter>

Thanks to @cosmo0920

Specify basic policy.

Specify each field policies. If a value for the field matches the pattern, the allow or deny rule is applied.

Patten is parsed by following rules.

• Integer: a value consisted of degits without “.”. e.g. status:200, price:10000

• Float: a value consisted of degits with “.” (if you force the value float, set 200.0). e.g. average:145.0

• Regexp: a value starting with “/” and end with “/”. e.g. path://user/d+/

  • thx @mmacvicar !

• String: a value unmatched below rule or enveloped with " or '.

1. Fork it

2. Create your feature branch (‘git checkout -b my-new-feature`)

3. Commit your changes (‘git commit -am ’Added some feature’‘)

4. Push to the branch (‘git push origin my-new-feature`)

5. Create new Pull Request