syslog-ng reference manual
Prev | Chapter 2. Message paths | Next

# Filters

Filters perform log routing inside syslog-ng. You can write a boolean expression using internal functions, which has to evaluate to true for the message to pass.

Filters have also a uniquely identifying name, so you can refer to filters in your log statements.

Syntax for the filter statement:

    	  filter <identifier> { expression; };

An expression may contain parentheses, the boolean operators "and", "or" and "not", and any of the functions listen in Table 3-14.

Example 2-2. A filter statement finding the messages containing the word deny coming from the host blurp

    	  filter f_blurp_deny { host("blurp") and match("deny"); };

For a complete description on the above functions, see Chapter 3.

In earlier revisions of syslog-ng there was a special filter identifier, "DEFAULT", which matched all not-yet-matched messages. This could make your configuration much simpler and easier to manage. This feature was removed in syslog-ng 1.5.x, and a more powerful idea was introduced. For more details consult the Section called Log paths.

Prev | Home | Next
Message paths | Up | Destinations