Filters

Filters perform log routing inside syslog-ng. You can write a boolean expression using internal functions, which has to evaluate to true for the message to pass.

Filters have also a uniquely identifying name, so you can refer to filters in your log statements.

Syntax for the filter statement:
	  filter <identifier> { expression; };
	
An expression may contain parentheses, the boolean operators "and", "or" and "not", and any of the functions listen in
Table 3-14.

Example 2-2. A filter statement finding the messages containing the word deny coming from the host blurp

	  filter f_blurp_deny { host("blurp") and match("deny"); };
	

For a complete description on the above functions, see Chapter 3.

In earlier revisions of syslog-ng there was a special filter identifier, "DEFAULT", which matched all not-yet-matched messages. This could make your configuration much simpler and easier to manage. This feature was removed in syslog-ng 1.5.x, and a more powerful idea was introduced. For more details consult the Section called Log paths.