Message Filter

The Filter section selects which stored syslog messages a feature, view, or report uses. The same three settings appear on feature editors and report requests. Views use Filter/Search (view requests and presets) or Layout Filter (layouts).

The filter runs after messages are in syslog storage, not on the collector’s incoming path. To discard traffic before it is stored, use the Incoming Filter.

Filter

When severity is all severity levels, originators is ALL ORIGINATORS, and the expression is blank, the caption shows [OFF].

Setting Description

Severity level

Inclusive range of syslog severities ((0) Emergency … (7) Debug). The full range is shown as all severity levels. Indexed — keep the range narrow.

Originators

ALL ORIGINATORS (every originator), <select originators> (a selected set), or Group: followed by an originator group name. Indexed.

Filter expression

Optional complex filter. Blank is shown as ALL MESSAGES (after severity and originators). A syntactically invalid expression is rejected on save (Please correct the syntax of the filter expression.).
Narrow by severity and originators first. Those predicates use storage indexes. The expression is evaluated only on rows that already passed those constraints.

The section menu on the caption:

  • Copy / Paste — clipboard

  • Export to File…​ / Import from File…​ — .filter or .json (both are JSON)

  • Reset Filter — all severity levels, ALL ORIGINATORS, blank expression

On a feature, type-specific exporters can add another per-section filter (advanced mode). A message must pass the feature filter and the section filter to use that section.

Related Topics