Filter event with VRL

[eruffini-gs]

I've been pulling my hair out trying to filter an event based on a string so that it does not get processed, and gets dropped. I have tried both "remap" and "filter" to no avail.
Remap:

  eventfilter_fingerprint:
    type: remap
    inputs:
      - syslogs
      - remote_syslog
      - remote_vector
    source: |
      if !contains(string!(.message),"fingerprint",case_sensitive: false) {
        abort
      }

Filter:

eventfilter_fingerprint:
  type: filter
  inputs:
    - syslogs
    - remote_syslog
    - remote_vector
  condition: '(contains(string!(.message), "fingerprint", case_sensitive: false))'

Basically, I want to filter out any events that contain "fingerprint" so that they do not get set to the sink.

It feels like I am missing something really simple.

[pront]

Hi @eruffini-gs, did you also inspect the logs that the filter transform is receiving? It's possible that none of the logs are filtered out because the .message value.

I tested this on a VRL terminal:

. = {}
{  }

.message = "foo"
"foo"

contains!(.message, "foo")
true

contains!(.message, "bar")
false