Live Workshop: Integrate Google SecOps with Bindplane - Join Us on January 29th at 11 AM ET!Sign Up Now

Log Sampling

Description

The Log Sampling processor can be used to filter out logs with a configured "drop ratio".

Supported Types

MetricsLogsTraces

Configuration Table

ParameterTypeDefaultDescription
drop_ratioenum"0.50"The probability an entry is dropped (used for sampling). A value of 1.0 will drop 100% of matching entries, while a value of 0.0 will drop 0%.
conditionstringtrueAn OTTL expression used to match which log records to sample from. All paths in the log context are available to reference. All converters are available to use.

note

Use of the condition parameter requires Bindplane Agent v1.61.0 or above.

Value drop ratio's range from "0.0" (0%) to "1.00" (100%) with 5% increments. Note that the drop ratio value is a string.

Example Configuration

Filter out 75% of logs where Attribute "ID" == 1.

Web Interface

observIQ docs - Log Sampling - image 1

Standalone Processor

yaml
1apiVersion: bindplane.observiq.com/v1
2kind: Processor
3metadata:
4  id: sampling
5  name: sampling
6spec:
7  type: sampling
8  parameters:
9    - name: drop_ratio
10      value: '0.75'
11    - name: condition
12      value: '(attributes["ID"] == 1)'