Combination Filters

George Alpizar
George Alpizar
  • Updated

Overview

This filter type allows you to combine already-existing filters into a single filter. 

In other words, you can use this filter to create a "parent" and "child" filter.  

Specifically, you can use and or or terms to determine how the filters will work with each other.  

As another option, as you create the parent filter, you can also create "child" filters. 


Review Parameters

Review the following parameters that you can configure in the Edge Delta App:

YAML Description
name

Enter a descriptive name for this filter.

When you create a workflow, you will use this label to enter your filter into the workflow.

This parameter is required. 

Review the following example:

name: combination_filter_or
type

Select (or enter) combinations.

This parameter is required. 

Review the following example:

type: combination
negate

You can use this parameter pass logs that do not meet the pattern. In other words, to reverse the effect of the filter, set this parameter to true.

  • For example, if you set the pattern to only collect error logs, and you set this parameter to true, then the filter will collect all logs that are not error logs.

This parameter is optional. 

Review the following example:

negate: true
operator

Enter and or or to determine how the "child" filter should interact with the "parent" filter. 

This parameter is optional. 

Review the following example:

operator: or
filters_list

You can use this parameter to add an existing filter or to create a new "child" filter under the "parent" filter. 

This parameter is optional. 

To add an existing filter, use the filter_name parameter to enter the name of the existing filter. 

Review the following example:

    filters_list:
      - filter_name: negate_custom_attributes_filter

To create a "child" filter, you must use the parameters mentioned in this document to define the new filter. 

Review the following example:

    filters_list:
      - pattern: "debug|DEBUG"
        negate: true

Review Sample Configuration

Review the following sample configuration: 

  - name: combination_filter_or
    type: combination
    operator: or
    filters_list:
      - filter_name: error
      - filter_name: custom_attributes_filter
  - name: negate_combination_filter_and
    type: combination
    operator: and
    filters_list:
      - pattern: "debug|DEBUG"
        negate: true
      - filter_name: negate_custom_attributes_filter
    negate: true

 

Share this document