Filter

Example Configuration

Drop debug logs

Config

Input

Output

1[transforms.my_transform_id]
2type = "filter"
3condition = '.level == "debug"'

1[
2  {
3    "log": {
4      "level": "debug",
5      "message": "I'm a noisy debug log"
6    }
7  },
8  {
9    "log": {
10      "level": "info",
11      "message": "I'm a normal info log"
12    }
13  }
14]

1[
2  {
3    "log": {
4      "level": "info",
5      "message": "I'm a normal info log"
6    }
7  }
8]

Configuration Options

Required Options

condition(required)

The condition to be matched against every input event. Only messages that pass the condition will be forwarded.

Type	Syntax	Default	Example
string	remap_boolean_expression		[".status_code != 200 && !includes([\"info\", \"debug\"], .severity)"]

inputs(required)

A list of upstream source or transform IDs. Wildcards (*) are supported.

See configuration for more info.

Type	Syntax	Default	Example
array	literal		["my-source-or-transform-id","prefix-*"]

type(required)

The component type. This is a required field for all components and tells Vector which component to use.

Type	Syntax	Default	Example
string	literal		["filter"]

Advanced Options

How it Works

State

This component is stateless, meaning its behavior is consistent across each input.