create_filter
Create a data filter on a module or integration pipeline to transform log data using steps like rename, add, grok, json, kv, or delete.
Instructions
Create a new data filter on a pipeline.
logstash_filter: the YAML pipeline text. Steps include rename, add (with where),
grok, json, kv, delete. Example to standardize a username value:
pipeline:
- dataTypes: [generic]
steps:
- add:
function: "string"
params: {key: target.user, value: "standard.name"}
where: equals("target.user", "legacy_name")NOTE: user filters can only be created on module/integration pipelines; the built-in Windows/Linux agent 'system' filters are edited in the web UI, not via this API. server: which configured server to target (default active/default).
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| active | No | ||
| server | No | ||
| data_type | Yes | ||
| filter_name | Yes | ||
| pipeline_id | Yes | ||
| data_type_id | Yes | ||
| logstash_filter | Yes |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |