Incoming Filter
The Filter section on the Message Processing tab discards unwanted messages immediately after the preprocessor — before they are written to syslog storage.
The filter is OFF until a criterion is set (the section header reads Filter [OFF]).
When It Runs
Most filtering in Syslog Watcher uses the Message Filter on stored messages (features, views, reports). The incoming filter runs before storage:
-
Discarded messages consume no storage space.
-
Discarded messages generate no further processing (originator handling, field extraction, features).
-
Only limited criteria are available — the message is not fully parsed at this stage.
Use it to drop high-volume, low-value traffic (for example debug-level noise) before it reaches storage.
Filter
Filter by severity
Drop messages below a minimum severity threshold. For example, Warning discards Informational, Notice, and Debug regardless of source.
The default is Do not discard (accept all levels).
| The severity used here is the one already normalized by the preprocessor. Messages without an original severity have the default severity assigned before this filter runs. |
Discard messages with keywords
Drop messages whose raw text contains any of the specified keywords.
This is the deny-list: patterns that must never be stored. Useful for known noisy messages.
Accept only messages with keywords
Drop every message whose raw text does not contain at least one of the specified keywords.
This is the allow-list: only messages matching a listed pattern are stored. Useful when only a narrow subset of traffic should be kept.
|
Keyword matching runs against the raw, unparsed message line — including the syslog header. Test patterns carefully to avoid discarding messages that should be stored. |
Regular expression filter
Drop or accept messages with a regular expression on the raw line. Use this when keywords are not enough (alternation, anchors, character classes).
| Setting | Description |
|---|---|
Regular expression filter |
Pattern tested against the raw line. Blank = this criterion is inactive. |
If message matches |
Accept it or Discard it. |
Incoming Filter and Message Filter
| Incoming Filter | Message Filter | |
|---|---|---|
When it runs |
After the preprocessor, before storage |
After the message is in storage |
Available fields |
Severity, raw keywords, regular expression |
All parsed fields (originator, facility, message body, timestamps, custom fields) |
Effect |
The message is never stored |
Features, views, and reports can include or exclude the message |
Use for |
High-volume noise reduction |
Fine-grained routing, export, and reporting |
For filters on stored messages, see Message Filter.
Performance
The incoming filter can cut storage I/O and processing load on high-volume networks. A severity filter that discards Debug messages can reduce storage growth substantially on verbose devices.
See Performance for throughput guidelines.