Remove Related Fields Filter

Definition

Description

If event matches Condition remove all fields whose name contains String.

Comments

If String is missing, blank or invalid, do nothing.

If any field name contains the string String (using case-sensitive compare), that field and its value will be removed from the event.

Example:
String = "set"

Event before:
set = "a set field"
ev:set2 = "whole message 33"
ev:msg = "another message"
ev:seTField = "hole"

Event after:
ev:msg = "another message"
ev:seTField = "hole"

Example

<filter objectId="RemoveReleated.one" type="RemoveRelatedFieldsFilter">
	<parameter type="Condition">
		<negatePrimaryCondition>false</negatePrimaryCondition>
		<conditionRelation>Any</conditionRelation>
		<conditionSpec> <!—changed name from “condition” -->
			<negate>false</negate>
			<fieldName>ev:host</fieldName>
			<operator>neq</operator>
			<valueType>string</valueType>
			<value>HOST_INVALID</value>
		</conditionSpec>
	</parameter>
	<parameter type="String">host</parameter>
</filter>