---
title: "FilterX use cases and examples"
url: "https://axoflow.com/docs/axosyslog-core/filterx/filterx-examples/"
description: "Common FilterX tasks: set, delete, and rename message fields, conditional rewrites, and an iptables parser written in FilterX."
last_modified: "2026-10-05T12:47:12+02:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axosyslog-core/llms.txt).

# FilterX use cases and examples

Common FilterX tasks: set, delete, and rename message fields, conditional rewrites, and an iptables parser written in FilterX.

## Common tasks

The following list shows you some common tasks that you can solve with FilterX:

- To set message fields (like macros or SDATA fields) or replace message parts: you can [assign values](https://axoflow.com/docs/axosyslog-core/filterx/filterx-language/index.md#assign-values)
  to change parts of the message, or use one of the [FilterX functions](https://axoflow.com/docs/axosyslog-core/filterx/function-reference/index.md)
  to rewrite existing values.

  > **Note:**
  > Hard macros cannot be modified. For details, see [Hard versus soft macros](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/customizing-message-format/macros-hard-vs-soft/index.md).
- To delete or unset message fields, see [Delete values](https://axoflow.com/docs/axosyslog-core/filterx/filterx-language/index.md#delete-values)
  .
- To rename a message field, assign the value of the old field to the new one, then unset the old field. For example:

  ```shell
  $my_new_field = $mike_old_field;
  unset($mike_old_field);
  ```
- To use conditional rewrites, you can either:

  - embed the FilterX block in an [if-else block](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/logpath/concepts-if-else-conditional-expressions/index.md)
    , or
  - use [value comparison in the FilterX block](https://axoflow.com/docs/axosyslog-core/filterx/filterx-comparing/index.md)
    to select the appropriate messages. For example, to rewrite only messages of the NGINX application, you can:

    ```shell
    ${PROGRAM} == "nginx";
    # <your rewrite expression>
    ```

## Create an iptables parser

The following example shows you how to reimplement the [iptables parser](https://axoflow.com/docs/axosyslog-core/chapter-parsers/parser-iptables/index.md) in a FilterX block. The following is a sample iptables log message (with line-breaks added for readability):

```shell
Dec 08 12:00:00 hostname.example kernel: custom-prefix:IN=eth0 OUT=
MAC=11:22:33:44:55:66:aa:bb:cc:dd:ee:ff:08:00 SRC=192.0.2.2 DST=192.168.0.1 LEN=40 TOS=0x00
PREC=0x00 TTL=232 ID=12345 PROTO=TCP SPT=54321 DPT=22 WINDOW=1023 RES=0x00 SYN URGP=0
```

This is a normal RFC3164-formatted message logged by the kernel (where iptables logging messages originate from), and contains space-separated key-value pairs.

1. First, create some filter statements to select iptables messages only:

   ```shell
   block filterx parse_iptables() {
       ${FACILITY} == "kern"; # Filter on the kernel facility
       ${PROGRAM} == "kernel"; # Sender application is the kernel
       ${MESSAGE} =~ "PROTO="; # The PROTO key appears in all iptables messages
   }
   ```
2. To make the parsed data available under macros beginning with `${.iptables}`, like in the case of the original `iptables-parser()`, create the `${.iptables}` JSON object.

   ```shell
   block filterx parse_iptables() {
       ${FACILITY} == "kern"; # Filter on the kernel facility
       ${PROGRAM} == "kernel"; # Sender application is the kernel
       ${MESSAGE} =~ "PROTO="; # The PROTO key appears in all iptables messages

       ${.iptables} = json(); # Create an empty JSON object
   }
   ```
3. Add a key=value parser to parse the content of the messages into the `${.iptables}` JSON object. The key=value pairs are space-separated, while equal signs (=) separates the values from the keys.

   ```shell
   block filterx parse_iptables() {
       ${FACILITY} == "kern"; # Filter on the kernel facility
       ${PROGRAM} == "kernel"; # Sender application is the kernel
       ${MESSAGE} =~ "PROTO="; # The PROTO key appears in all iptables messages

       ${.iptables} = json(); # Create an empty JSON object

       ${.iptables} = parse_kv(${MESSAGE}, value_separator="=", pair_separator=" ");
   }
   ```

For other examples on parsing messages, see the [Parsing firewall logs with FilterX](https://axoflow.com/blog/parsing-firewall-logs-with-filterx)
blog post.

Last modified October 5, 2026: [Filterx page ordering updates (1d4505aa)](https://github.com/axoflow/axosyslog-core-docs/commit/1d4505aa3316750978f5aa8463972d4c1f4ec48a)