Use a filter to identify or discard logs.

You can use a filter to identify or discard logs or to protect sensitive data. As a result, filters can help reduce the agent’s resource load because of the reduced log ingestion. You can also use a filter to refine and transform collected logs before additional processing takes place.

Some input types offer additional filtering options that you can use to compliment the generic filters on this page. For example, when you create a Kubernetes input, you can add a filter in the input definition for a namespace or pod.

See the instructions for configuring an agent.


Decode base64.


Combine existing filters into a single filter.

Custom attribute

Identify logs with a specific field name and matching values.


Modify data as it is being streamed through the Edge Delta agent.

Enrichment JavaScript

Enrich logs using a JavaScript function.

Drop JSON Field

Drop specified JSON fields.

Extract JSON Field

Extract specified JSON field.

Filter with JavaScript

Filter logs based on a JavaScript function.

Transform with JavaScript

Transform logs based on a JavaScript function.


Mask values based on regex.


Pass logs based on regex.

Split Logs

Match then split a single log into multiple logs.

Source Detection

Assign logs to sources using field mappings..

Beta Filters

Filters that are in beta.