1
- # Filtering Details
1
+ # Matching Details
2
2
3
3
## Overview
4
4
5
- This application takes an array of hashes passed to the ` filters ` parameter
5
+ This application takes an array of hashes passed to the ` matches ` parameter
6
6
within a ` systemd ` typed source definition in your ` fluent.conf ` configuration
7
7
file and then parses them into a format understood by ` libsystemd ` 's journal
8
8
API. The basis behind what ` libsystemd ` 's API expects can be found documented in
9
9
the ` journalctl ` [ man
10
10
page] ( https://www.freedesktop.org/software/systemd/man/journalctl.html ) .
11
11
12
+ The result of this is that only logs which match the defined set of matching
13
+ rules will be further processed.
14
+
12
15
## Usage Information
13
16
14
- In order to utilize this plugin's filtering capabilities, you will need to
17
+ In order to utilize this plugin's matching capabilities, you will need to
15
18
understand how this plugin transforms the passed array of hashes into a format
16
19
that is understood by ` libsystemd ` .
17
20
18
21
The best way to describe this process is probably by example. The following
19
22
sub-sections lists out various scenarios that you might wish to perform with
20
- this plugin's filtering mechanism and describes both how to configure them,
23
+ this plugin's matching mechanism and describes both how to configure them,
21
24
while also mapping them to examples from the ` journalctl ` [ man
22
25
page] ( https://www.freedesktop.org/software/systemd/man/journalctl.html ) .
23
26
24
27
### No Filters
25
28
26
- You can leave the ` filters ` property out altogether, or include a ` filters `
27
- property with an empty array (as shown below) to specify that no filtering
29
+ You can leave the ` matches ` property out altogether, or include a ` matches `
30
+ property with an empty array (as shown below) to specify that no matching
28
31
should occur.
29
32
30
- filters []
33
+ matches []
31
34
32
- Which matches this part of the ` journalctl ` man page:
35
+ Which coincides with this part of the ` journalctl ` man page:
33
36
34
37
> Without arguments, all collected logs are shown unfiltered:
35
38
>
36
39
> ` journalctl `
37
40
38
41
### Single Filter
39
42
40
- You can pass a single hash map to the ` filters ` array with a single key/value
41
- pair specified to filter out all log entries that do not match the given
42
- field/value combination.
43
+ You can pass a single hash map to the ` matches ` array with a single key/value
44
+ pair specified to only process log entries that match the given field/value
45
+ combination.
43
46
44
47
For example:
45
48
46
- filters [{"_SYSTEMD_UNIT": "avahi-daemon.service"}]
49
+ matches [{"_SYSTEMD_UNIT": "avahi-daemon.service"}]
47
50
48
51
Which coincides with this part of the the ` journalctl ` man page:
49
52
@@ -54,17 +57,17 @@ Which coincides with this part of the the `journalctl` man page:
54
57
55
58
### Multi-Field Filters
56
59
57
- You can pass a single hash map to the ` filters ` array with multiple key/value
58
- pairs to filter out all log entries that do not match the combination of all of
59
- the specified key/value combinations.
60
+ You can pass a single hash map to the ` matches ` array with multiple key/value
61
+ pairs to only process log entries that match the combination of all of the
62
+ specified key/value combinations.
60
63
61
64
The passed key/value pairs are treated as a logical ` AND ` , such that all of the
62
65
pairs must be true in order to allow further processing of the current log
63
66
entry.
64
67
65
68
For Example:
66
69
67
- filters [{"_SYSTEMD_UNIT": "avahi-daemon.service", "_PID": 28097}]
70
+ matches [{"_SYSTEMD_UNIT": "avahi-daemon.service", "_PID": 28097}]
68
71
69
72
Which coincides with this part of the the ` journalctl ` man page:
70
73
@@ -74,15 +77,15 @@ Which coincides with this part of the the `journalctl` man page:
74
77
> ` journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 `
75
78
76
79
You can also perform a logical ` OR ` by splitting key/value pairs across multiple
77
- hashes passed to the ` filters ` array like so:
80
+ hashes passed to the ` matches ` array like so:
78
81
79
- filters [{"_SYSTEMD_UNIT": "avahi-daemon.service"}, {"_PID": 28097}]
82
+ matches [{"_SYSTEMD_UNIT": "avahi-daemon.service"}, {"_PID": 28097}]
80
83
81
84
You can combine both ` AND ` and ` OR ` combinations together; using a single hash
82
85
map to define conditions that ` AND ` together and using multiple hash maps to
83
86
define conditions that ` OR ` together like so:
84
87
85
- filters [{"_SYSTEMD_UNIT": "avahi-daemon.service", "_PID": 28097}, {"_SYSTEMD_UNIT": "dbus.service"}]
88
+ matches [{"_SYSTEMD_UNIT": "avahi-daemon.service", "_PID": 28097}, {"_SYSTEMD_UNIT": "dbus.service"}]
86
89
87
90
This can be expressed in psuedo-code like so:
88
91
@@ -105,7 +108,7 @@ Fields with arrays as values are treated as a logical `OR` statement.
105
108
106
109
For example:
107
110
108
- filters [{"_SYSTEMD_UNIT": ["avahi-daemon.service", "dbus.service"]}]
111
+ matches [{"_SYSTEMD_UNIT": ["avahi-daemon.service", "dbus.service"]}]
109
112
110
113
Which coincides with this part of the ` journalctl ` man page:
111
114
@@ -119,7 +122,7 @@ particularly helpful when you want to create aggregate logic
119
122
120
123
For example:
121
124
122
- filters [{"_SYSTEMD_UNIT": "avahi-daemon.service", "_PID": 28097}, {"_SYSTEMD_UNIT": "dbus.service"}]
125
+ matches [{"_SYSTEMD_UNIT": "avahi-daemon.service", "_PID": 28097}, {"_SYSTEMD_UNIT": "dbus.service"}]
123
126
124
127
This can be expressed in psuedo-code like so:
125
128
0 commit comments