Filter ClauseFilter


Discard records which do not match a clause given as a boolean S-expression. Check the filter documentation for some examples.

ClauseFilter boolean expression format

This document describes the s-expression format used in ClauseFilter.

The format uses s-expressions. Empty string matches anything (i.e. all records will pass the expression).

There are only three keywords: and, or, not

If an s-expression starts with any other name, it is assumed to be the name of a field and it should be paired with the desired value to match against.

Must match both X and Y to pass:
(and X Y)

You can use more than 2 arguments:
(and X Y Z A B C)

Must match either X or Y to pass:
(or X Y)

Must NOT match X to pass:
(not X)

Field must equal value to pass:

(fieldName somevalue)

Matches anything (because only one argument)
(and X)

Matches nothing

Matches anything


(and (fieldName value1) (anotherFieldName value2))

(or (fieldName value1) (fieldName value2))

(not (or (fieldName value1) (fieldName value2)))

  (and (fieldName value1)
       (anotherFieldName value3))
  (and (fieldName value2)
       (anotherFieldName value4)))


Keys available in the [filter.config] section:

Name Type Default Required Description
Clause string "" false Boolean formula describing which events to let through. If empty, let everything through.
Last modified December 12, 2022