All Products
Search

This Product

    Simple Log Service:Native plug-in: Data Filtering

    Document Center

    Simple Log Service:Native plug-in: Data Filtering

    Last Updated:Apr 18, 2025

    You can use a Logtail plug-in to filter logs based on specific field values.

    Entry point

    If you want to use a Logtail plug-in to process logs, you can add a Logtail plug-in configuration when you create or modify a Logtail configuration. For more information, see Overview.

    Configuration description

    Parameter

    Description

    Whitelist

    The log whitelist. Only logs that meet the specified conditions in the whitelist can be collected. You must specify field names and regular expressions that are used to filter logs. The specified regular expressions support only full-text matching. Keyword matching is not supported. For more information about how to specify a regular expression, see Getting started with regular expressions.

    The whitelist conditions are evaluated by using a logical AND. Examples:

    • Collect the logs that match the specified filter conditions.

      • If you set the Field Name parameter to level and the Field Value parameter to WARNING|ERROR, only the logs in which the value of the level field is WARNING or ERROR are collected.

      • If you set the Field Name parameter to content and the Field Value parameter to .*05\/Jan\/2023.*, only the logs in which the value of the content field contains 05/Jan/2023 are collected.

    • Filter out the logs that do not match the specified filter conditions.

      • If you set the Field Name parameter to level and the Field Value parameter to ^(?!.*(INFO|DEBUG)).*, logs in which the value of the level field contains INFO or DEBUG are not collected.

      • If you set the Field Name parameter to level and the Field Value parameter to ^(?!(INFO|DEBUG)$).*, logs in which the value of the level field is INFO or DEBUG are not collected.

      • If you set the Field Name parameter to url and the Field Value parameter to .*^(?!.*(healthcheck)).*, logs in which the value of the url field contains healthcheck are not collected.