All Products
Search

This Product

    Simple Log Service:Native plug-in: Data Filtering

    Document Center

    Simple Log Service:Native plug-in: Data Filtering

    Last Updated:Aug 22, 2025

    You can use a Logtail plug-in to filter logs based on specific field values.

    Entry point

    If you want to use a Logtail plug-in to process logs, you can add a Logtail plug-in configuration when you create or modify a Logtail configuration. For more information, see Overview.

    Configuration description

    Parameter

    Description

    Whitelist

    The log whitelist. Only logs that meet the specified conditions in the whitelist can be collected. You must specify field names and regular expressions that are used to filter logs. The specified regular expressions support only full-text matching. Keyword matching is not supported. For more information about how to specify a regular expression, see Getting started with regular expressions.

    The whitelist conditions are evaluated using a logical AND. Examples:

    • Collect the logs that match the specified filter conditions.

      • Set Field Name to level and Field Value to WARNING|ERROR. Only the logs in which the value of the level field is WARNING or ERROR are collected.

      • Set Field Name to content and Field Value to .*05\/Jan\/2023.*. Only the logs in which the value of the content field contains 05/Jan/2023 are collected.

    • Filter out the logs that do not match the specified filter conditions.

      • Set Field Name to level and Field Value to ^(?!.*(INFO|DEBUG)).*. Logs in which the value of the level field contains INFO or DEBUG are not collected.

      • Set Field Name to level and Field Value to ^(?!(INFO|DEBUG)$).*. Logs in which the value of the level field is INFO or DEBUG are not collected.

      • Set Field Name to url and Field Value to .*^(?!.*(healthcheck)).*. Logs in which the value of the url field contains healthcheck are not collected.

    References