From 91a83e63b8f60d3c99340f4105970ed8bbc4a7db Mon Sep 17 00:00:00 2001 From: May Lee Date: Mon, 8 Dec 2025 15:05:59 -0500 Subject: [PATCH 1/4] update and add shortcodes --- .../processors/filter_syntax.en.md | 4 ++-- .../filter_syntax_logs_metrics.en.md | 22 +++++++++++++++++++ .../processors/filter_syntax_metrics.en.md | 13 +++++++++++ 3 files changed, 37 insertions(+), 2 deletions(-) create mode 100644 layouts/shortcodes/observability_pipelines/processors/filter_syntax_logs_metrics.en.md create mode 100644 layouts/shortcodes/observability_pipelines/processors/filter_syntax_metrics.en.md diff --git a/layouts/shortcodes/observability_pipelines/processors/filter_syntax.en.md b/layouts/shortcodes/observability_pipelines/processors/filter_syntax.en.md index 89d497c927b..cdc79e3d48b 100644 --- a/layouts/shortcodes/observability_pipelines/processors/filter_syntax.en.md +++ b/layouts/shortcodes/observability_pipelines/processors/filter_syntax.en.md @@ -1,8 +1,8 @@ #### Filter query syntax -Each processor has a corresponding filter query in their fields. Processors only process logs that match their filter query. And for all processors except the filter processor, logs that do not match the query are sent to the next step of the pipeline. For the filter processor, logs that do not match the query are dropped. +Each processor has a corresponding filter query in their fields. Processors only process logs that match their filter query. And for all processors except the Filter processor, logs that do not match the query are sent to the next step of the pipeline. For the Filter processor, logs that do not match the query are dropped. -The following are filter query examples: +The following are logs filter query examples: - `NOT (status:debug)`: This filters for logs that do not have the status `DEBUG`. - `status:ok service:flask-web-app`: This filters for all logs with the status `OK` from your `flask-web-app` service. diff --git a/layouts/shortcodes/observability_pipelines/processors/filter_syntax_logs_metrics.en.md b/layouts/shortcodes/observability_pipelines/processors/filter_syntax_logs_metrics.en.md new file mode 100644 index 00000000000..6d748a5e96d --- /dev/null +++ b/layouts/shortcodes/observability_pipelines/processors/filter_syntax_logs_metrics.en.md @@ -0,0 +1,22 @@ +#### Filter query syntax + +Each processor has a corresponding filter query in their fields. Processors only process logs or metrics that match their filter query. And for all processors except the Filter processor, logs or metrics that do not match the query are sent to the next step of the pipeline. For the Filter processor, logs or metrics that do not match the query are dropped. + +The following are logs filter query examples: + +- `NOT (status:debug)`: This filters for logs that do not have the status `DEBUG`. +- `status:ok service:flask-web-app`: This filters for all logs with the status `OK` from your `flask-web-app` service. + - This query can also be written as: `status:ok AND service:flask-web-app`. +- `host:COMP-A9JNGYK OR host:COMP-J58KAS`: This filter query only matches logs from the labeled hosts. +- `user.status:inactive`: This filters for logs with the status `inactive` nested under the `user` attribute. +- `http.status:[200 TO 299]` or `http.status:{300 TO 399}`: These two filters represent the syntax to query a range for `http.status`. Ranges can be used across any attribute. + +The following are metrics filter query examples: + +- `NOT system.cpu.user`: This filters for metrics that do not have the status `name:system.cpu.user`. +- `system.cpu.user OR system.cpu.user.total`: This filter query only matches metrics that have either `name:system.cpu.user` or `name:system.cpu.user.total`. +- `tags:(env\:prod OR env\:test)` : This filters for metrics with `env:prod` or `env:test` in `tags`. + +Learn more about writing filter queries in [Observability Pipelines Search Syntax][4001]. + +[4001]: /observability_pipelines/search_syntax/ diff --git a/layouts/shortcodes/observability_pipelines/processors/filter_syntax_metrics.en.md b/layouts/shortcodes/observability_pipelines/processors/filter_syntax_metrics.en.md new file mode 100644 index 00000000000..ed55efd4243 --- /dev/null +++ b/layouts/shortcodes/observability_pipelines/processors/filter_syntax_metrics.en.md @@ -0,0 +1,13 @@ +#### Filter query syntax + +Each processor has a corresponding filter query in their fields. Processors only process metrics that match their filter query. And for all processors except the Filter processor, metrics that do not match the query are sent to the next step of the pipeline. For the Filter processor, metrics that do not match the query are dropped. + +The following are metrics filter query examples: + +- `NOT system.cpu.user`: This filters for metrics that do not have the status `name:system.cpu.user`. +- `system.cpu.user OR system.cpu.user.total`: This filter query only matches metrics that have either `name:system.cpu.user` or `name:system.cpu.user.total`. +- `tags:(env\:prod OR env\:test)` : This filters for metrics with `env:prod` or `env:test` in `tags`. + +Learn more about writing metrics filter queries in [Observability Pipelines Metrics Search Syntax][4002]. + +[4002]: /observability_pipelines/search_syntax/metrics/ From 55106a91ee184365b53d0b9840be41db3dfc101d Mon Sep 17 00:00:00 2001 From: May Lee Date: Mon, 8 Dec 2025 15:27:44 -0500 Subject: [PATCH 2/4] Update layouts/shortcodes/observability_pipelines/processors/filter_syntax_metrics.en.md --- .../processors/filter_syntax_metrics.en.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/layouts/shortcodes/observability_pipelines/processors/filter_syntax_metrics.en.md b/layouts/shortcodes/observability_pipelines/processors/filter_syntax_metrics.en.md index ed55efd4243..bad5b142cca 100644 --- a/layouts/shortcodes/observability_pipelines/processors/filter_syntax_metrics.en.md +++ b/layouts/shortcodes/observability_pipelines/processors/filter_syntax_metrics.en.md @@ -6,7 +6,7 @@ The following are metrics filter query examples: - `NOT system.cpu.user`: This filters for metrics that do not have the status `name:system.cpu.user`. - `system.cpu.user OR system.cpu.user.total`: This filter query only matches metrics that have either `name:system.cpu.user` or `name:system.cpu.user.total`. -- `tags:(env\:prod OR env\:test)` : This filters for metrics with `env:prod` or `env:test` in `tags`. +- `tags:(env\:prod OR env\:test)`: This filters for metrics with `env:prod` or `env:test` in `tags`. Learn more about writing metrics filter queries in [Observability Pipelines Metrics Search Syntax][4002]. From 32aba20b59fcdc531328464f78da2054c2fb2e4e Mon Sep 17 00:00:00 2001 From: May Lee Date: Mon, 8 Dec 2025 15:28:00 -0500 Subject: [PATCH 3/4] Update layouts/shortcodes/observability_pipelines/processors/filter_syntax_logs_metrics.en.md --- .../processors/filter_syntax_logs_metrics.en.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/layouts/shortcodes/observability_pipelines/processors/filter_syntax_logs_metrics.en.md b/layouts/shortcodes/observability_pipelines/processors/filter_syntax_logs_metrics.en.md index 6d748a5e96d..ebda3646204 100644 --- a/layouts/shortcodes/observability_pipelines/processors/filter_syntax_logs_metrics.en.md +++ b/layouts/shortcodes/observability_pipelines/processors/filter_syntax_logs_metrics.en.md @@ -15,7 +15,7 @@ The following are metrics filter query examples: - `NOT system.cpu.user`: This filters for metrics that do not have the status `name:system.cpu.user`. - `system.cpu.user OR system.cpu.user.total`: This filter query only matches metrics that have either `name:system.cpu.user` or `name:system.cpu.user.total`. -- `tags:(env\:prod OR env\:test)` : This filters for metrics with `env:prod` or `env:test` in `tags`. +- `tags:(env\:prod OR env\:test)`: This filters for metrics with `env:prod` or `env:test` in `tags`. Learn more about writing filter queries in [Observability Pipelines Search Syntax][4001]. From 89589c8b27bc9693fb64538ae156494b0213ff55 Mon Sep 17 00:00:00 2001 From: May Lee Date: Tue, 9 Dec 2025 11:54:57 -0500 Subject: [PATCH 4/4] small edit --- .../processors/filter_syntax_logs_metrics.en.md | 2 +- .../processors/filter_syntax_metrics.en.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/layouts/shortcodes/observability_pipelines/processors/filter_syntax_logs_metrics.en.md b/layouts/shortcodes/observability_pipelines/processors/filter_syntax_logs_metrics.en.md index ebda3646204..3da03fdeeb8 100644 --- a/layouts/shortcodes/observability_pipelines/processors/filter_syntax_logs_metrics.en.md +++ b/layouts/shortcodes/observability_pipelines/processors/filter_syntax_logs_metrics.en.md @@ -13,7 +13,7 @@ The following are logs filter query examples: The following are metrics filter query examples: -- `NOT system.cpu.user`: This filters for metrics that do not have the status `name:system.cpu.user`. +- `NOT system.cpu.user`: This filters for metrics that do not have the field `name:system.cpu.user`. - `system.cpu.user OR system.cpu.user.total`: This filter query only matches metrics that have either `name:system.cpu.user` or `name:system.cpu.user.total`. - `tags:(env\:prod OR env\:test)`: This filters for metrics with `env:prod` or `env:test` in `tags`. diff --git a/layouts/shortcodes/observability_pipelines/processors/filter_syntax_metrics.en.md b/layouts/shortcodes/observability_pipelines/processors/filter_syntax_metrics.en.md index bad5b142cca..8620f006f60 100644 --- a/layouts/shortcodes/observability_pipelines/processors/filter_syntax_metrics.en.md +++ b/layouts/shortcodes/observability_pipelines/processors/filter_syntax_metrics.en.md @@ -4,7 +4,7 @@ Each processor has a corresponding filter query in their fields. Processors only The following are metrics filter query examples: -- `NOT system.cpu.user`: This filters for metrics that do not have the status `name:system.cpu.user`. +- `NOT system.cpu.user`: This filters for metrics that do not have the field `name:system.cpu.user`. - `system.cpu.user OR system.cpu.user.total`: This filter query only matches metrics that have either `name:system.cpu.user` or `name:system.cpu.user.total`. - `tags:(env\:prod OR env\:test)`: This filters for metrics with `env:prod` or `env:test` in `tags`.