1- # Filtering Details
1+ # Matching Details
22
33## Overview
44
5- This application takes an array of hashes passed to the ` filters ` parameter
5+ This application takes an array of hashes passed to the ` matches ` parameter
66within a ` systemd ` typed source definition in your ` fluent.conf ` configuration
77file and then parses them into a format understood by ` libsystemd ` 's journal
88API. The basis behind what ` libsystemd ` 's API expects can be found documented in
99the ` journalctl ` [ man
1010page] ( https://www.freedesktop.org/software/systemd/man/journalctl.html ) .
1111
12+ The result of this is that only logs which match the defined set of matching
13+ rules will be further processed.
14+
1215## Usage Information
1316
14- In order to utilize this plugin's filtering capabilities, you will need to
17+ In order to utilize this plugin's matching capabilities, you will need to
1518understand how this plugin transforms the passed array of hashes into a format
1619that is understood by ` libsystemd ` .
1720
1821The best way to describe this process is probably by example. The following
1922sub-sections lists out various scenarios that you might wish to perform with
20- this plugin's filtering mechanism and describes both how to configure them,
23+ this plugin's matching mechanism and describes both how to configure them,
2124while also mapping them to examples from the ` journalctl ` [ man
2225page] ( https://www.freedesktop.org/software/systemd/man/journalctl.html ) .
2326
2427### No Filters
2528
26- You can leave the ` filters ` property out altogether, or include a ` filters `
27- property with an empty array (as shown below) to specify that no filtering
29+ You can leave the ` matches ` property out altogether, or include a ` matches `
30+ property with an empty array (as shown below) to specify that no matching
2831should occur.
2932
30- filters []
33+ matches []
3134
32- Which matches this part of the ` journalctl ` man page:
35+ Which coincides with this part of the ` journalctl ` man page:
3336
3437> Without arguments, all collected logs are shown unfiltered:
3538>
3639> ` journalctl `
3740
3841### Single Filter
3942
40- You can pass a single hash map to the ` filters ` array with a single key/value
41- pair specified to filter out all log entries that do not match the given
42- field/value combination.
43+ You can pass a single hash map to the ` matches ` array with a single key/value
44+ pair specified to only process log entries that match the given field/value
45+ combination.
4346
4447For example:
4548
46- filters [{"_SYSTEMD_UNIT": "avahi-daemon.service"}]
49+ matches [{"_SYSTEMD_UNIT": "avahi-daemon.service"}]
4750
4851Which coincides with this part of the the ` journalctl ` man page:
4952
@@ -54,17 +57,17 @@ Which coincides with this part of the the `journalctl` man page:
5457
5558### Multi-Field Filters
5659
57- You can pass a single hash map to the ` filters ` array with multiple key/value
58- pairs to filter out all log entries that do not match the combination of all of
59- the specified key/value combinations.
60+ You can pass a single hash map to the ` matches ` array with multiple key/value
61+ pairs to only process log entries that match the combination of all of the
62+ specified key/value combinations.
6063
6164The passed key/value pairs are treated as a logical ` AND ` , such that all of the
6265pairs must be true in order to allow further processing of the current log
6366entry.
6467
6568For Example:
6669
67- filters [{"_SYSTEMD_UNIT": "avahi-daemon.service", "_PID": 28097}]
70+ matches [{"_SYSTEMD_UNIT": "avahi-daemon.service", "_PID": 28097}]
6871
6972Which coincides with this part of the the ` journalctl ` man page:
7073
@@ -74,15 +77,15 @@ Which coincides with this part of the the `journalctl` man page:
7477> ` journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 `
7578
7679You can also perform a logical ` OR ` by splitting key/value pairs across multiple
77- hashes passed to the ` filters ` array like so:
80+ hashes passed to the ` matches ` array like so:
7881
79- filters [{"_SYSTEMD_UNIT": "avahi-daemon.service"}, {"_PID": 28097}]
82+ matches [{"_SYSTEMD_UNIT": "avahi-daemon.service"}, {"_PID": 28097}]
8083
8184You can combine both ` AND ` and ` OR ` combinations together; using a single hash
8285map to define conditions that ` AND ` together and using multiple hash maps to
8386define conditions that ` OR ` together like so:
8487
85- filters [{"_SYSTEMD_UNIT": "avahi-daemon.service", "_PID": 28097}, {"_SYSTEMD_UNIT": "dbus.service"}]
88+ matches [{"_SYSTEMD_UNIT": "avahi-daemon.service", "_PID": 28097}, {"_SYSTEMD_UNIT": "dbus.service"}]
8689
8790This can be expressed in psuedo-code like so:
8891
@@ -105,7 +108,7 @@ Fields with arrays as values are treated as a logical `OR` statement.
105108
106109For example:
107110
108- filters [{"_SYSTEMD_UNIT": ["avahi-daemon.service", "dbus.service"]}]
111+ matches [{"_SYSTEMD_UNIT": ["avahi-daemon.service", "dbus.service"]}]
109112
110113Which coincides with this part of the ` journalctl ` man page:
111114
@@ -119,7 +122,7 @@ particularly helpful when you want to create aggregate logic
119122
120123For example:
121124
122- filters [{"_SYSTEMD_UNIT": "avahi-daemon.service", "_PID": 28097}, {"_SYSTEMD_UNIT": "dbus.service"}]
125+ matches [{"_SYSTEMD_UNIT": "avahi-daemon.service", "_PID": 28097}, {"_SYSTEMD_UNIT": "dbus.service"}]
123126
124127This can be expressed in psuedo-code like so:
125128
0 commit comments