Free Report! Gartner® Hype Cycle™ for Monitoring and Observability.Read more

Filter by Regex

Filter by Regex Processor

The Filter by Regex processor can be used to include or exclude logs based on Regex matching body fields. This processor is exclusive to the Google license.


Enterprise and Free users should use the Filter By Condition processor, which has more robust filtering.

ActionThe action to take when the filter condition is met. Include will retain matching logs. Exclude will remove matching logs.
RegexThe regular expression (Regex) that logs will be evaluated against.
MatchThe type containing the field the Regex will be evaluated against. Options are "Body" and "Attributes".
Field (Body)If Field Type is set to "body", this is the name of the body field Regex will be evaluated against. Leave empty to apply to the entire body.
Field (Attributes)If Field Type is set to "attributes", this is the name of the attribute field Regex will be evaluated against.

Example Configuration

In this example, we exclude logs that have the body field "path" matching this Regex: .+(?:ql).

Web Interface

observIQ docs - Filter by Regex Processor - image 1

Standalone Processor

2kind: Processor
4  id: filter_regex
5  name: filter_regex
7  type: google_filter_regex
8  parameters:
9    - name: action
10      value: exclude
11    - name: regex
12      value: '.+(?:ql)'
13    - name: field_type
14      value: 'Body'
15    - name: body_field
16      value: 'path'