Filter Transform

The filter transform drops or keeps events based on conditions you define. Use it to remove health checks, exclude debug logs, or keep only production traffic before data reaches your sinks.

Quick start

Drop events where path equals /health:

[[routing.rules.transformers]]
type = "filter"
action = "drop"
field = "path"
operator = "eq"
value = "/health"

Actions

Action	What happens
`drop` (default)	Remove events that match — keep everything else
`keep`	Keep only events that match — remove everything else

Operators

Operator	Type	Description
`eq`	String/Number	Equal to value
`ne`	String/Number	Not equal to value
`contains`	String	Contains substring
`starts_with`	String	Starts with prefix
`ends_with`	String	Ends with suffix
`regex`	String	Matches regex pattern
`exists`	Any	Field exists (no value needed)
`gt`	Numeric	Greater than
`gte`	Numeric	Greater than or equal
`lt`	Numeric	Less than
`lte`	Numeric	Less than or equal

Multiple conditions

When you need more than one condition, use the conditions array and set match to control how they combine:

[[routing.rules.transformers]]
type = "filter"
action = "drop"
match = "any"

[[routing.rules.transformers.conditions]]
field = "path"
operator = "eq"
value = "/health"

[[routing.rules.transformers.conditions]]
field = "path"
operator = "starts_with"
value = "/metrics"

Match mode	Logic
`all` (default)	All conditions must match (AND)
`any`	Any condition can match (OR)

Examples

Keep only errors from production:

[[routing.rules.transformers]]
type = "filter"
action = "keep"
match = "all"

[[routing.rules.transformers.conditions]]
field = "level"
operator = "eq"
value = "error"

[[routing.rules.transformers.conditions]]
field = "env"
operator = "eq"
value = "production"

Drop events matching a regex:

[[routing.rules.transformers]]
type = "filter"
action = "drop"
field = "user_agent"
operator = "regex"
value = "bot|crawler|spider"

Keep events where a user ID exists:

[[routing.rules.transformers]]
type = "filter"
action = "keep"
field = "user_id"
operator = "exists"

Filter on nested fields (dot notation):

[[routing.rules.transformers]]
type = "filter"
action = "drop"
field = "request.headers.x-internal"
operator = "exists"

Reference

Field	Default	Description
`type`	—	`"filter"`
`action`	`"drop"`	`"drop"` or `"keep"`
`match`	`"all"`	`"all"` (AND) or `"any"` (OR)
`field`	—	Field path (single-condition shorthand)
`operator`	`"eq"`	Operator for single-condition shorthand
`value`	—	Value to compare (not needed for `exists`)
`conditions`	—	Array of `{field, operator, value}` objects
`enabled`	`true`	Set to `false` to disable

Non-JSON messages pass through unchanged — conditions only evaluate against JSON fields.

Getting Started

Tracking

Pipeline

Analytics

Installing

Filter Transform

Quick start

Actions

Operators

Multiple conditions

Examples

Reference

​Quick start

​Actions

​Operators

​Multiple conditions

​Examples

​Reference

Quick start

Actions

Operators

Multiple conditions

Examples

Reference