Filters

Filters perform log routing inside syslog-ng. You can write a boolean expression using internal functions, which has to evaluate to true for the message to pass.

Filters have also a uniquely identifying name, so you can refer to filters in your log statements. Syntax for the filter statement:
	  filter <identifier> { expression; };
	
An expression may contain the operators "and", "or" and "not", and any of the functions listed below.

Example 2-2. A filter statement finding the messages containing the word deny coming from the host blurp

	  filter f_blurp_deny { host("blurp") and match("deny"); };
	

Table 2-3. Available filter functions in syslog-ng

FunctionDescription
facility()Selects messages based on their facility code
level() or priority()Selects messages based on their priority
program()Tries to match a regular expression to the program name field of log messages
host()Tries to match a regular expression to the hostname field of log messages
match()Tries to match a regular expression to the message itself.
filter()Call another filter rule and evaluate its value

For a complete description on the above functions, see the Reference chapter.

There's a special filter identifier "DEFAULT" which allows you to catch not-yet-handled messages. For example, consider the following configuration:
	  options { keep_hostname(yes); }; 

	  source src { unix-stream("proba2"); internal(); };
	  
	  destination ftpd { file("ftplog"); };
	  destination named { file("namedlog"); };
	  destination daemon { file("daemonlog"); };
	  
	  filter f_ftpd { match("ftp"); };
	  filter f_named { match("named"); };
	  filter f_daemon { facility(daemon); };
	  
	  log { source(src); filter(f_ftpd); destination(ftpd); };
	  log { source(src); filter(f_named); destination(named); };
	  log { source(src); filter(f_daemon); filter(DEFAULT); destination(daemon); };
	  
	
The default filter above catches all facility=daemon messages which are not caught by the filter f_ftpd and f_named.