Filter by Regex

The Filter by Regex processor includes or excludes log records based on whether a regular expression matches the log body or an attribute field. Exclude drops matching logs; Include keeps only matching logs and drops the rest.

Supported Telemetry Types

Platform	Metrics	Logs	Traces
Linux		✓
Windows		✓
macOS		✓
AIX		✓
Kubernetes Node		✓
Kubernetes Cluster		✓
Kubernetes Gateway		✓
OpenShift Node		✓
OpenShift Cluster		✓
OpenShift Gateway		✓
Google SecOps Pipelines		✓

Configuration

Parameter	Type	Required	Default	Description
Action	Enum: include, exclude	No	exclude	The action to take when the regex matches. Include retains matching logs and drops the rest. Exclude removes matching logs.
Regex	Code Block	Yes	(empty)	The regular expression that logs are evaluated against.
Match	Enum: Body, Attributes	No	Body	The type containing the field the regex is evaluated against.
Field	OTTL Field	No	(empty)	When Match is Body, the body field to evaluate. Use bracket notation for nested fields (e.g. parent["child"]). Leave empty to evaluate the entire body.
Field	OTTL Field	No	(empty)	When Match is Attributes, the attribute field to evaluate. Use bracket notation for nested fields (e.g. parent["child"]). Leave empty to evaluate the entire attributes map.

Use case

Use Filter by Regex for quick body or single-field regex filtering. For multi-field logic, comparisons across signal types, or OTTL conditions beyond a single regex, the Filter by Condition processor provides more expressive filtering.

Examples

Exclude logs whose path ends in ql

This configuration drops any log whose body field path matches the regex .+(?:ql), for example requests to a GraphQL endpoint.

- name: action
  value: exclude
- name: regex
  value: '.+(?:ql)'
- name: field_type
  value: Body
- name: body_field
  value: path

Include only logs with a matching attribute

This configuration keeps only logs whose http.target attribute matches ^/api/, dropping everything else.

- name: action
  value: include
- name: regex
  value: '^/api/'
- name: field_type
  value: Attributes
- name: attribute_field
  value: http.target

Configuration Tips

• Leave Field empty to evaluate the entire body or attributes map; set it to target a single field.
• The regex follows RE2 syntax. Anchor patterns (^, $) when you need a full-string match, since IsMatch succeeds on any substring match.
• Include keeps only matching logs and drops everything else, which is easy to over-apply. Verify the pattern against sample data before deploying with Include.

Troubleshooting

No logs are filtered

Symptoms: matching logs still pass through unchanged.

Solutions:

1. Confirm Match is set to the correct type (Body vs Attributes) for where the field lives.
2. Verify the Field name and bracket notation match the actual record structure, or leave Field empty to evaluate the whole body or attributes map.
3. Check that the regex matches the data; recall that a bare pattern matches any substring.

Too many logs are dropped

Symptoms: more logs are removed than expected.

Solutions:

1. With Action set to Include, every non-matching log is dropped. Switch to Exclude if you intended to remove only the matches.
2. Anchor the regex (^, $) to avoid unintended substring matches.

Standalone Processor

apiVersion: bindplane.observiq.com/v1
kind: Processor
metadata:
  name: filter-by-regex
spec:
  type: google_filter_regex
  parameters:
    - name: action
      value: exclude
    - name: regex
      value: '.+(?:ql)'
    - name: field_type
      value: Body
    - name: body_field
      value: path

Related Resources

• Filter Processor — OpenTelemetry Collector Contrib

Bindplane Resources

• Filter by Condition