Specifying filters for the filter codec
You specify each filter as a codec property. The filter codec plug-in applies each filter you specify to incoming and outgoing events as they pass through the codec. The property name identifies the field(s) that the filter applies to and the property value specifies the condition that must be true for the filter to operate.
The general syntax of a filter specification is:
<property name="filter[.direction][.field_name]" value="condition" />
direction | Indicates the direction of the events that the filter applies to. Specify downstream, upstream, or both. The default is both. |
field_name | Identifies the field that the filter applies to. The default is that the filter applies to all fields in the event. |
condition | Specifies the value that the field must have that causes it to be removed from the event. |