:plugin: range :type: filter /////////////////////////////////////////// START - GENERATED VARIABLES, DO NOT EDIT! /////////////////////////////////////////// :version: %VERSION% :release_date: %RELEASE_DATE% :changelog_url: %CHANGELOG_URL% :include_path: ../../../../logstash/docs/include /////////////////////////////////////////// END - GENERATED VARIABLES, DO NOT EDIT! /////////////////////////////////////////// [id="plugins-{type}s-{plugin}"] === Range filter plugin include::{include_path}/plugin_header.asciidoc[] ==== Description This filter is used to check that certain fields are within expected size/length ranges. Supported types are numbers and strings. Numbers are checked to be within numeric value range. Strings are checked to be within string length range. More than one range can be specified for same fieldname, actions will be applied incrementally. When field value is within a specified range an action will be taken. Supported actions are drop event, add tag, or add field with specified value. Example use cases are for histogram-like tagging of events or for finding anomaly values in fields or too big events that should be dropped. [id="plugins-{type}s-{plugin}-options"] ==== Range Filter Configuration Options This plugin supports the following configuration options plus the <> described later. [cols="<,<,<",options="header",] |======================================================================= |Setting |Input type|Required | <> |<>|No | <> |<>|No |======================================================================= Also see <> for a list of options supported by all filter plugins.   [id="plugins-{type}s-{plugin}-negate"] ===== `negate` * Value type is <> * Default value is `false` Negate the range match logic, events should be outsize of the specified range to match. [id="plugins-{type}s-{plugin}-ranges"] ===== `ranges` * Value type is <> * Default value is `[]` An array of field, min, max, action tuples. Example: [source,ruby] filter { range { ranges => [ "message", 0, 10, "tag:short", "message", 11, 100, "tag:medium", "message", 101, 1000, "tag:long", "message", 1001, 1e1000, "drop", "duration", 0, 100, "field:latency:fast", "duration", 101, 200, "field:latency:normal", "duration", 201, 1000, "field:latency:slow", "duration", 1001, 1e1000, "field:latency:outlier", "requests", 0, 10, "tag:too_few_%{host}_requests" ] } } Supported actions are drop tag or field with specified value. Added tag names and field names and field values can have `%{dynamic}` values. [id="plugins-{type}s-{plugin}-common-options"] include::{include_path}/{type}.asciidoc[]