Filter Lists

A filter list is a named set of values, one per line. With IN / NOT_IN, a filter expression checks a field against all items of a list at once, instead of a long chain of or.

Filters can only use lists in syslog storage. To use a list shipped with the product (Installation), duplicate it first.

Create a List

  1. In the Storage section of the main toolbar, click More More → Filter Lists…​

  2. Click Create New, or select a list and click Duplicate.

  3. Enter a Name: and the items (see Filter List).

  4. Click Create.

Filter List

Setting Description

Name:

Required, unique. Filter expressions refer to the list by this name: {APPNAME} IN "allowed_apps".

Description:

Optional.

Filter list items, one per line:

One value per line. Empty lines are skipped. Lines are not trimmed: spaces are part of the value.

Example items:

LINK-3-UPDOWN
LINK-3-LINK_FAULT
LINK-3-TOOSMALL

IN / NOT_IN

IN is true when the field value, after its modifiers, exactly equals an item of the named list.

{APPNAME} IN "allowed_apps"
{ORIGINATOR_ID} IN "block_list"
{MSGID|lower} IN "known_errors"

NOT_IN is the inverse: {MSGID} NOT_IN "known_errors" is the same as not {MSGID} IN "known_errors".

If no list has that name, IN is always false and NOT_IN is always true.

See Filter Expressions for operators.