Complex Filter Syntax

A filter expression selects messages using message fields, comparison operators, and / or / not, and parentheses. It is the Filter expression on the message filter (and extra per-rule filters on some features).

An empty expression matches every message that already passed severity and originators.

Narrow by severity and originators on the message filter first. Those constraints use storage indexes.

Syntax

A comparison is a field in braces, an operator, and a value (quoted text or an unquoted number).

({APPNAME} = "server" or {APPNAME} STARTS_WITH "client") and {MSGID} > 404

Field names can include modifiers:

{MESSAGE|lower} CONTAINS "blocked"

String values use double quotes. Double each " that is part of the value:

{MESSAGE} CONTAINS "begin ""quoted part"" end"

Operator names are case-sensitive and uppercase (CONTAINS, not contains). Substring operators (CONTAINS, STARTS_WITH, ENDS_WITH) are also case-sensitive on the text. {MESSAGE|lower} (or UPPER) makes a case-insensitive comparison.

and / or / not

Logic keywords are lowercase: and, or, not. AND, OR, and NOT are invalid.

or is split first, so and binds tighter: A or B and C is A or (B and C). not applies to the subexpression that follows it: {A} = "x" and not {B} = "y".

Parentheses override that order. Spaces around keywords are optional.

Operators

Operator Meaning

= !=

Equal / not equal (text).

< ⇐ > >=

Ordered comparison. Quoted values compare as text. An unquoted number compares as an integer.

INT< INT⇐ INT> INT>=

Integer comparison even when the right-hand side is quoted. There is no INT=.

CONTAINS DOES_NOT_CONTAIN

Substring (case-sensitive).

STARTS_WITH ENDS_WITH

Prefix / suffix (case-sensitive).

IN NOT_IN

Exact membership in a filter list (list name in quotes).

RE_MATCHES RE_MATCHES_I

The whole field matches a regular expression (case-sensitive / ignore case).

RE_CONTAINS RE_CONTAINS_I

Part of the field matches a regular expression (case-sensitive / ignore case).

 
{MESSAGE} RE_CONTAINS ".+\@.+\..+"

Integer Comparison

Unquoted numbers (digits, optional minus) use the integer form of < ⇐ > >=.

{MSGID} > 404

Quoted digits compare as text unless an INT… operator is used:

{MSGID} > "404"
{MSGID} INT> "404"

Filter Lists

IN / NOT_IN test whether the formatted field equals an item in the named list — not a substring.

{APPNAME} IN "allowed_apps"
{ORIGINATOR_ID} IN "block_list"
{MSGID|lower} IN "known_errors"

NOT_IN is the inverse of IN: {MSGID} NOT_IN "known_errors" is the same as not {MSGID} IN "known_errors".

Regular Expressions

RE_MATCHES requires the entire field to match. RE_CONTAINS succeeds when the pattern occurs anywhere in the field. The _I forms ignore case.

An invalid pattern, or a pattern that is too long, never matches (the comparison is false).

Limits

The expression may be at most 64 KB. Nesting (and / or / not / parentheses) may be at most 256 levels deep. A longer or deeper expression is rejected.

Related Topics