<filter>
directive:foo.bar
, and if the message
field's value contains cool
, the events go through the rest of the configuration.<match>
directive for output plugins, <filter>
matches against a tag. Once the event is processed by the filter, the event proceeds through the configuration top-down. Hence, if there are multiple filters for the same tag, they are applied in descending order. Hence, in the following example:message
field contain cool
get the new field hostname
with the machine's hostname as its value.filter
method. If the plugin which uses filter_stream
exists, chain optimization is disabled.