> For the complete documentation index, see [llms.txt](https://docs.bindplane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bindplane.com/integrations/processors/secops-filter.md).

# SecOps Filter

Filters logs in the Google SecOps export path so only the records you want reach the destination. Choose one of two methods: match log bodies to include or exclude them, or supply a list of OTTL conditions that drop any matching log. This processor is logs-only.

### Supported Telemetry Types

| Logs | Metrics | Traces |
| ---- | ------- | ------ |
| ✓    |         |        |

This processor acts on logs only. Metrics and traces pass through unchanged.

### Configuration

#### Basic Configuration

<figure><img src="/files/ge1btQ7nOxhRqmasq2Tc" alt="Bindplane docs - SecOps Filter - image 1"><figcaption></figcaption></figure>

**Filter method**

| Parameter     | Type                              | Required | Default    | Description                                                                                                                                                                                                                     |
| ------------- | --------------------------------- | -------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Filter Method | Enum: Include/Exclude, Conditions | Yes      | Conditions | How to filter. **Include/Exclude** matches log bodies against patterns to keep or drop them. **Conditions** drops any log for which one of a list of OTTL conditions is true. The remaining fields shown depend on this choice. |

**Include**

Shown when Filter Method is **Include/Exclude**.

| Parameter           | Type                 | Required | Default   | Description                                                                                                                                                           |
| ------------------- | -------------------- | -------- | --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Include Match Type  | Enum: strict, regexp | No       | strict    | How included bodies are matched. `strict` matches the exact string; `regexp` matches with a regular expression. Applies when Filter Method is Include/Exclude.        |
| Included Log Bodies | Code Blocks          | No       | *(empty)* | Strings to match against the log body. A log whose body matches any of these (using the match type above) is included. Applies when Filter Method is Include/Exclude. |

**Exclude**

Shown when Filter Method is **Include/Exclude**.

| Parameter           | Type                 | Required | Default   | Description                                                                                                                                                           |
| ------------------- | -------------------- | -------- | --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Exclude Match Type  | Enum: strict, regexp | No       | strict    | How excluded bodies are matched. `strict` matches the exact string; `regexp` matches with a regular expression. Applies when Filter Method is Include/Exclude.        |
| Excluded Log Bodies | Code Blocks          | No       | *(empty)* | Strings to match against the log body. A log whose body matches any of these (using the match type above) is excluded. Applies when Filter Method is Include/Exclude. |

**Conditions**

| Parameter      | Type        | Required | Default   | Description                                                                                                                            |
| -------------- | ----------- | -------- | --------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| Log Conditions | Code Blocks | No       | *(empty)* | A list of OTTL conditions. If any condition resolves to true for a log, that log is dropped. Applies when Filter Method is Conditions. |

**Advanced**

| Parameter  | Type                    | Required | Default | Description                                                                                                                                        |
| ---------- | ----------------------- | -------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| Error Mode | Enum: ignore, propagate | No       | ignore  | How to handle errors during processing. `ignore` logs the error and continues. `propagate` halts processing and returns the error up the pipeline. |

### Examples

#### Drop debug logs by condition

The default method, **Conditions**, drops any log for which a listed OTTL condition is true. To drop debug-level logs, set Filter Method to Conditions and add a single condition:

```
severity_number < SEVERITY_NUMBER_INFO
```

Any log with a severity below INFO is dropped; everything else passes through to Google SecOps.

#### Halt on error with a body-match filter

<figure><img src="/files/O2cfpERnbcGxwufcOqwQ" alt="Bindplane docs - SecOps Filter - image 2"><figcaption></figcaption></figure>

This example sets the advanced **Error Mode** to `propagate` so processing stops and surfaces the error rather than silently continuing. Filter Method is Include/Exclude: a regexp include keeps only logs whose body matches `ERROR` or `WARN`, and a strict exclude drops a known noisy healthcheck line.

* Filter Method: Include/Exclude
* Include Match Type: regexp
* Included Log Bodies: `ERROR`, `WARN`
* Exclude Match Type: strict
* Excluded Log Bodies: `healthcheck`
* Error Mode: propagate

### Configuration Tips

* Filter Method drives which fields apply. With **Conditions**, a log is dropped when any condition is true. With **Include/Exclude**, includes keep matching logs and excludes drop them.
* Leave **Error Mode** at `ignore` for normal operation. Use `propagate` only when you want a malformed record to fail the pipeline instead of being skipped.
* With **regexp** match types, the strings in the body lists are treated as regular expressions, so escape any literal regex metacharacters.

### Troubleshooting

#### Logs are not being dropped or kept as expected

Symptoms: more or fewer logs reach Google SecOps than intended.

Solutions:

1. Confirm Filter Method matches the fields you configured. Include/Exclude only uses the body lists; Conditions only uses the OTTL conditions.
2. For Include/Exclude, check the match type. A `strict` entry must equal the whole body exactly; use `regexp` for partial matches.
3. For Conditions, remember the semantics are drop-on-true: a condition that is true causes the log to be dropped.

### Standalone Processor

```yaml
apiVersion: bindplane.observiq.com/v1
kind: Processor
metadata:
  name: secops-filter
spec:
  type: secops_filter
  parameters:
    - name: filter_method
      value: Conditions
    - name: log_conditions
      value:
        - severity_number < SEVERITY_NUMBER_INFO
    - name: error_mode
      value: ignore
```

### Related Resources

* [filter processor — OpenTelemetry Collector Contrib reference](https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/processor/filterprocessor/README.md)
* [OTTL — OpenTelemetry Transformation Language reference](https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/pkg/ottl/README.md)

### Bindplane Resources

This processor removes logs from the Google SecOps export path. It is different from **Google SecOps Standardization**, which standardizes and normalizes fields on logs rather than dropping or keeping them. Use this Filter to decide which logs are sent, and use Standardization to shape the logs that are sent.

* [Google SecOps Standardization](/integrations/processors/google-secops-standardization.md)
* [Filter by Condition](/integrations/processors/filter-by-condition.md)
* [Filter by Field](/integrations/processors/filter-by-field.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.bindplane.com/integrations/processors/secops-filter.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.