SecOps Filter

Filters logs in the Google SecOps export path so only the records you want reach the destination. Choose one of two methods: match log bodies to include or exclude them, or supply a list of OTTL conditions that drop any matching log. This processor is logs-only.

Supported Telemetry Types

Logs	Metrics	Traces
✓

This processor acts on logs only. Metrics and traces pass through unchanged.

Configuration

Basic Configuration

Filter method

Parameter	Type	Required	Default	Description
Filter Method	Enum: Include/Exclude, Conditions	Yes	Conditions	How to filter. Include/Exclude matches log bodies against patterns to keep or drop them. Conditions drops any log for which one of a list of OTTL conditions is true. The remaining fields shown depend on this choice.

Include

Shown when Filter Method is Include/Exclude.

Parameter	Type	Required	Default	Description
Include Match Type	Enum: strict, regexp	No	strict	How included bodies are matched. strict matches the exact string; regexp matches with a regular expression. Applies when Filter Method is Include/Exclude.
Included Log Bodies	Code Blocks	No	(empty)	Strings to match against the log body. A log whose body matches any of these (using the match type above) is included. Applies when Filter Method is Include/Exclude.

Exclude

Shown when Filter Method is Include/Exclude.

Parameter	Type	Required	Default	Description
Exclude Match Type	Enum: strict, regexp	No	strict	How excluded bodies are matched. strict matches the exact string; regexp matches with a regular expression. Applies when Filter Method is Include/Exclude.
Excluded Log Bodies	Code Blocks	No	(empty)	Strings to match against the log body. A log whose body matches any of these (using the match type above) is excluded. Applies when Filter Method is Include/Exclude.

Conditions

Parameter	Type	Required	Default	Description
Log Conditions	Code Blocks	No	(empty)	A list of OTTL conditions. If any condition resolves to true for a log, that log is dropped. Applies when Filter Method is Conditions.

Advanced

Parameter	Type	Required	Default	Description
Error Mode	Enum: ignore, propagate	No	ignore	How to handle errors during processing. ignore logs the error and continues. propagate halts processing and returns the error up the pipeline.

Examples

Drop debug logs by condition

The default method, Conditions, drops any log for which a listed OTTL condition is true. To drop debug-level logs, set Filter Method to Conditions and add a single condition:

severity_number < SEVERITY_NUMBER_INFO

Any log with a severity below INFO is dropped; everything else passes through to Google SecOps.

Halt on error with a body-match filter

This example sets the advanced Error Mode to propagate so processing stops and surfaces the error rather than silently continuing. Filter Method is Include/Exclude: a regexp include keeps only logs whose body matches ERROR or WARN, and a strict exclude drops a known noisy healthcheck line.

• Filter Method: Include/Exclude
• Include Match Type: regexp
• Included Log Bodies: ERROR, WARN
• Exclude Match Type: strict
• Excluded Log Bodies: healthcheck
• Error Mode: propagate

Configuration Tips

• Filter Method drives which fields apply. With Conditions, a log is dropped when any condition is true. With Include/Exclude, includes keep matching logs and excludes drop them.
• Leave Error Mode at ignore for normal operation. Use propagate only when you want a malformed record to fail the pipeline instead of being skipped.
• With regexp match types, the strings in the body lists are treated as regular expressions, so escape any literal regex metacharacters.

Troubleshooting

Logs are not being dropped or kept as expected

Symptoms: more or fewer logs reach Google SecOps than intended.

Solutions:

1. Confirm Filter Method matches the fields you configured. Include/Exclude only uses the body lists; Conditions only uses the OTTL conditions.
2. For Include/Exclude, check the match type. A strict entry must equal the whole body exactly; use regexp for partial matches.
3. For Conditions, remember the semantics are drop-on-true: a condition that is true causes the log to be dropped.

Standalone Processor

apiVersion: bindplane.observiq.com/v1
kind: Processor
metadata:
  name: secops-filter
spec:
  type: secops_filter
  parameters:
    - name: filter_method
      value: Conditions
    - name: log_conditions
      value:
        - severity_number < SEVERITY_NUMBER_INFO
    - name: error_mode
      value: ignore

Related Resources

• filter processor — OpenTelemetry Collector Contrib reference
• OTTL — OpenTelemetry Transformation Language reference

Bindplane Resources

This processor removes logs from the Google SecOps export path. It is different from Google SecOps Standardization, which standardizes and normalizes fields on logs rather than dropping or keeping them. Use this Filter to decide which logs are sent, and use Standardization to shape the logs that are sent.

• Google SecOps Standardization
• Filter by Condition
• Filter by Field