> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tell.rs/llms.txt
> Use this file to discover all available pages before exploring further.

# Filter Transform

> Drop or keep events based on field conditions — string, numeric, regex, and existence checks.

The filter transform drops or keeps events based on conditions you define. Use it to remove health checks, exclude debug logs, or keep only production traffic before data reaches your sinks.

## Quick start

Drop events where `path` equals `/health`:

```toml theme={null}
[[routing.rules.transformers]]
type = "filter"
action = "drop"
field = "path"
operator = "eq"
value = "/health"
```

## Actions

| Action           | What happens                                         |
| ---------------- | ---------------------------------------------------- |
| `drop` (default) | Remove events that match — keep everything else      |
| `keep`           | Keep only events that match — remove everything else |

## Operators

| Operator      | Type          | Description                    |
| ------------- | ------------- | ------------------------------ |
| `eq`          | String/Number | Equal to value                 |
| `ne`          | String/Number | Not equal to value             |
| `contains`    | String        | Contains substring             |
| `starts_with` | String        | Starts with prefix             |
| `ends_with`   | String        | Ends with suffix               |
| `regex`       | String        | Matches regex pattern          |
| `exists`      | Any           | Field exists (no value needed) |
| `gt`          | Numeric       | Greater than                   |
| `gte`         | Numeric       | Greater than or equal          |
| `lt`          | Numeric       | Less than                      |
| `lte`         | Numeric       | Less than or equal             |

## Multiple conditions

When you need more than one condition, use the `conditions` array and set `match` to control how they combine:

```toml theme={null}
[[routing.rules.transformers]]
type = "filter"
action = "drop"
match = "any"

[[routing.rules.transformers.conditions]]
field = "path"
operator = "eq"
value = "/health"

[[routing.rules.transformers.conditions]]
field = "path"
operator = "starts_with"
value = "/metrics"
```

| Match mode      | Logic                           |
| --------------- | ------------------------------- |
| `all` (default) | All conditions must match (AND) |
| `any`           | Any condition can match (OR)    |

## Examples

**Keep only errors from production:**

```toml theme={null}
[[routing.rules.transformers]]
type = "filter"
action = "keep"
match = "all"

[[routing.rules.transformers.conditions]]
field = "level"
operator = "eq"
value = "error"

[[routing.rules.transformers.conditions]]
field = "env"
operator = "eq"
value = "production"
```

**Drop events matching a regex:**

```toml theme={null}
[[routing.rules.transformers]]
type = "filter"
action = "drop"
field = "user_agent"
operator = "regex"
value = "bot|crawler|spider"
```

**Keep events where a user ID exists:**

```toml theme={null}
[[routing.rules.transformers]]
type = "filter"
action = "keep"
field = "user_id"
operator = "exists"
```

**Filter on nested fields** (dot notation):

```toml theme={null}
[[routing.rules.transformers]]
type = "filter"
action = "drop"
field = "request.headers.x-internal"
operator = "exists"
```

## Reference

| Field        | Default  | Description                                 |
| ------------ | -------- | ------------------------------------------- |
| `type`       | —        | `"filter"`                                  |
| `action`     | `"drop"` | `"drop"` or `"keep"`                        |
| `match`      | `"all"`  | `"all"` (AND) or `"any"` (OR)               |
| `field`      | —        | Field path (single-condition shorthand)     |
| `operator`   | `"eq"`   | Operator for single-condition shorthand     |
| `value`      | —        | Value to compare (not needed for `exists`)  |
| `conditions` | —        | Array of `{field, operator, value}` objects |
| `enabled`    | `true`   | Set to `false` to disable                   |

Non-JSON messages pass through unchanged — conditions only evaluate against JSON fields.