filtering

noun

The action of limiting a set of events or fields within events by imposing criteria on them.

In the context of forwarding, you can filter and route events to specified indexers or queues. In the context of searching, you can construct searches that filter search results to remove unwanted events or fields. In addition, certain configuration files, such as inputs.conf and serverclass.conf provide attributes that allow you to impose whitelist and blacklist filtering rules for various purposes.

For more information

In the Search Manual:

• About the search language

In the Distributed Deployment Manual:

• Route and filter data
• Define server classes

In the Getting Data In Manual:

• White list or blacklist specific incoming data

• Alphabetical
• By Topic