You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
not [classic configuration files](../../administration/configuring-fluent-bit/classic-mode/README.md).
16
+
Conditional processing is only available for [YAML configuration files](../../administration/configuring-fluent-bit/yaml/README.md), not [classic configuration files](../../administration/configuring-fluent-bit/classic-mode/README.md).
16
17
{% endhint %}
17
18
18
19
@@ -38,15 +39,19 @@ pipeline:
38
39
<...>
39
40
```
40
41
41
-
Each processor can only have a single `condition` block, but can have multiple rules within that condition.
42
-
These rules are stored as items in the `condition.rules` array.
42
+
Each processor can only have a single `condition` block, but that condition can
43
+
include multiple rules. These rules are stored as items in the `condition.rules`
44
+
array.
43
45
44
46
### Condition evaluation
45
47
46
-
The `condition.op` parameter specifies the condition's evaluation logic. It has two possible values:
48
+
The `condition.op` parameter specifies the condition's evaluation logic. It has
49
+
two possible values:
47
50
48
-
-`and`: All rules in the `condition.rules` array must evaluate to `true` for the condition to be met.
49
-
-`or`: One or more rules in the `conditions.rules` array must evaluate to `true` for the condition to be met.
51
+
-`and`: A log entry meets this condition when all of the rules in the `condition.rules`
52
+
are [truthy](https://developer.mozilla.org/en-US/docs/Glossary/Truthy).
53
+
-`or`: A log entry meets this condition when one or more rules in the `condition.rules`
54
+
array are [truthy](https://developer.mozilla.org/en-US/docs/Glossary/Truthy).
50
55
51
56
### Rules
52
57
@@ -56,7 +61,7 @@ Each item in the `condition.rules` array must include values for the following p
56
61
| --- | --- |
57
62
|`field`| The field within your logs to evaluate. The value of this parameter must use [the correct syntax](#field-access) to access the fields inside logs. |
58
63
|`op`| The [comparison operator](#comparison-operators) to evaluate whether the rule is true. This parameter (`condition.rules.op`) is distinct from the `condition.op` parameter and has different possible values. |
59
-
|`value`| The value of the specified log field to use in your comparison. Optionally, you can provide [an array that contains multiple values](#array-of-values). |
64
+
|`value`| The value of the specified log field to use in your comparison. Optionally, you can provide [an array that contains multiple values](#array-of-values). |
60
65
61
66
Rules are evaluated against each log that passes through your data pipeline. For example, given a rule with these parameters:
62
67
@@ -93,7 +98,8 @@ The `conditions.rules.op` parameter has the following possible values:
93
98
94
99
### Basic condition
95
100
96
-
This example applies a condition that only processes logs that contain the string `{"request": {"method": "POST"`:
101
+
This example applies a condition that only processes logs that contain the
102
+
string `{"request": {"method": "POST"`:
97
103
98
104
```yaml
99
105
pipeline:
@@ -117,7 +123,8 @@ pipeline:
117
123
118
124
### Multiple conditions with `and`
119
125
120
-
This example applies a condition that only processes logs when all of the specified rules are met:
126
+
This example applies a condition that only processes logs when all of the
127
+
specified rules are met:
121
128
122
129
```yaml
123
130
pipeline:
@@ -144,7 +151,8 @@ pipeline:
144
151
145
152
### Multiple conditions with `or`
146
153
147
-
This example applies a condition that only processes logs when one or more of the specified rules are met:
154
+
This example applies a condition that only processes logs when one or more of
155
+
the specified rules are met:
148
156
149
157
```yaml
150
158
pipeline:
@@ -234,4 +242,5 @@ pipeline:
234
242
value: ["error", "fatal"]
235
243
```
236
244
237
-
This configuration would add the `alert` field to error logs from critical services, and add the `paging_required` field to errors containing specific critical patterns.
245
+
This configuration adds an `alert` field to error logs from critical services,
246
+
and adds a `paging_required` field to errors that contain specific critical patterns.
0 commit comments