Filter log with regular expressions

[LinTechSo]

Hi all.
i add tag label on my logs and
i need filter some tag by using specific regex in transform vector but doesn't work with below configuration. would you please help me figure this out. tag: log-test-[name]

transforms:
  to_json:
    type: remap
    inputs:
      - input_logs
    source: |
      . = parse_json!(.message)

  block_test_logs:
    type: filter
    inputs:
      - to_json
    condition:
      type: vrl
      source:  .tag != r'log-test-(.*)'

[jszwedko]

Hi @LinTechSo ! You need to use the match VRL function. What you have there is comparing the tag to a literal regular expression value rather than checking if the regex matches the value.

[LinTechSo]

Hi @jszwedko . Thanks alot for the reply.
now i change my configuration as below

  block_test:
    type: filter
    inputs:
      - input_logs
    condition:
      type: vrl
      source: match(to_string!(.tag), r'log-test-(.*)')

but my problem is that, this match return true and doesnt block log-test-.* at all.
Do we have not match vrl function ? or should i do these such things in remap transform with if conditions ?

thanks.

[spencergilbert]

https://vector.dev/docs/reference/vrl/expressions/#logical-example-not

You're looking for !match(...)

[pingping95]

sources:
  in:
    type: stdin

transforms:
  filter:
    type: filter
    inputs:
      - in
    condition:
      type: "vrl"
      source: |-
        true != match(to_string!(.message), r'.*/health.*')

sinks:
  console:
    type: console
    inputs:
      - filter
    encoding:
      codec: json

It works