Skip to main content
The filter transform drops or keeps events based on conditions you define. Use it to remove health checks, exclude debug logs, or keep only production traffic before data reaches your sinks.

​
Quick start

Drop events where path equals /health: 
[[routing.rules.transformers]]
type = "filter"
action = "drop"
field = "path"
operator = "eq"
value = "/health"

​
Actions

ActionWhat happens
drop (default)Remove events that match — keep everything else
keepKeep only events that match — remove everything else

​
Operators

OperatorTypeDescription
eqString/NumberEqual to value
neString/NumberNot equal to value
containsStringContains substring
starts_withStringStarts with prefix
ends_withStringEnds with suffix
regexStringMatches regex pattern
existsAnyField exists (no value needed)
gtNumericGreater than
gteNumericGreater than or equal
ltNumericLess than
lteNumericLess than or equal

​
Multiple conditions

When you need more than one condition, use the conditions array and set match to control how they combine: 
[[routing.rules.transformers]]
type = "filter"
action = "drop"
match = "any"

[[routing.rules.transformers.conditions]]
field = "path"
operator = "eq"
value = "/health"

[[routing.rules.transformers.conditions]]
field = "path"
operator = "starts_with"
value = "/metrics"
Match modeLogic
all (default)All conditions must match (AND)
anyAny condition can match (OR)

​
Examples

Keep only errors from production: 
[[routing.rules.transformers]]
type = "filter"
action = "keep"
match = "all"

[[routing.rules.transformers.conditions]]
field = "level"
operator = "eq"
value = "error"

[[routing.rules.transformers.conditions]]
field = "env"
operator = "eq"
value = "production"
Drop events matching a regex: 
[[routing.rules.transformers]]
type = "filter"
action = "drop"
field = "user_agent"
operator = "regex"
value = "bot|crawler|spider"
Keep events where a user ID exists: 
[[routing.rules.transformers]]
type = "filter"
action = "keep"
field = "user_id"
operator = "exists"
Filter on nested fields (dot notation): 
[[routing.rules.transformers]]
type = "filter"
action = "drop"
field = "request.headers.x-internal"
operator = "exists"

​
Reference

FieldDefaultDescription
type—"filter"
action"drop""drop" or "keep"
match"all""all" (AND) or "any" (OR)
field—Field path (single-condition shorthand)
operator"eq"Operator for single-condition shorthand
value—Value to compare (not needed for exists)
conditions—Array of {field, operator, value} objects
enabledtrueSet to false to disable
Non-JSON messages pass through unchanged — conditions only evaluate against JSON fields.