Documentation Index
Fetch the complete documentation index at: https://docs.tell.rs/llms.txt
Use this file to discover all available pages before exploring further.
The filter transform drops or keeps events based on conditions you define. Use it to remove health checks, exclude debug logs, or keep only production traffic before data reaches your sinks.
Quick start
Drop events where path equals /health:
[[routing.rules.transformers]]
type = "filter"
action = "drop"
field = "path"
operator = "eq"
value = "/health"
Actions
| Action | What happens |
|---|
drop (default) | Remove events that match — keep everything else |
keep | Keep only events that match — remove everything else |
Operators
| Operator | Type | Description |
|---|
eq | String/Number | Equal to value |
ne | String/Number | Not equal to value |
contains | String | Contains substring |
starts_with | String | Starts with prefix |
ends_with | String | Ends with suffix |
regex | String | Matches regex pattern |
exists | Any | Field exists (no value needed) |
gt | Numeric | Greater than |
gte | Numeric | Greater than or equal |
lt | Numeric | Less than |
lte | Numeric | Less than or equal |
Multiple conditions
When you need more than one condition, use the conditions array and set match to control how they combine:
[[routing.rules.transformers]]
type = "filter"
action = "drop"
match = "any"
[[routing.rules.transformers.conditions]]
field = "path"
operator = "eq"
value = "/health"
[[routing.rules.transformers.conditions]]
field = "path"
operator = "starts_with"
value = "/metrics"
| Match mode | Logic |
|---|
all (default) | All conditions must match (AND) |
any | Any condition can match (OR) |
Examples
Keep only errors from production:
[[routing.rules.transformers]]
type = "filter"
action = "keep"
match = "all"
[[routing.rules.transformers.conditions]]
field = "level"
operator = "eq"
value = "error"
[[routing.rules.transformers.conditions]]
field = "env"
operator = "eq"
value = "production"
[[routing.rules.transformers]]
type = "filter"
action = "drop"
field = "user_agent"
operator = "regex"
value = "bot|crawler|spider"
[[routing.rules.transformers]]
type = "filter"
action = "keep"
field = "user_id"
operator = "exists"
[[routing.rules.transformers]]
type = "filter"
action = "drop"
field = "request.headers.x-internal"
operator = "exists"
Reference
| Field | Default | Description |
|---|
type | — | "filter" |
action | "drop" | "drop" or "keep" |
match | "all" | "all" (AND) or "any" (OR) |
field | — | Field path (single-condition shorthand) |
operator | "eq" | Operator for single-condition shorthand |
value | — | Value to compare (not needed for exists) |
conditions | — | Array of {field, operator, value} objects |
enabled | true | Set to false to disable |
