Reuse FilterX blocks

To use a FilterX block in multiple log paths, you have to define it as a separate block:

block filterx <identifier>() {
    <filterx-statement-1>;
    <filterx-statement-2>;
    ...
};

Then use it in a log path:

log {
    source(s1);
    filterx { <identifier>(); };
    destination(d1);
};

For example, the following FilterX statement selects the messages that contain the word deny and come from the host example.

block filterx demo_filterx() {
    ${HOST} == "example";
    ${MESSAGE} =~ "deny";
};
log {
    source(s1);
    filterx { demo_filterx(); };
    destination(d1);
};

Last modified October 2, 2026: Filterx example syntax fix (99fdc6cb)