# Update filters to FilterX

The following sections show you how you can change your existing filters and rewrite rules to FilterX statements. Note that:

  * Many examples in the FilterX documentation were adapted from the existing filter, parser, and rewrite examples to show how you can achieve the same functionality with FilterX.
  * Don’t worry if you can’t update something to FilterX. While you can’t use other blocks within a FilterX block, you can use both in a log statement, for example, you can use a FilterX block, then a parser if needed.
  * There is no push to use FilterX. You can keep using the traditional blocks if they satisfy your requirements.



## Update filters to FilterX

This section shows you how to update your existing `filter` expressions to `filterx`.

You can replace most [filter functions](../../docs/axosyslog-core/chapter-routing-filters/filters/index.md) with a simple value comparison of the appropriate macro, for example:

  * `facility(user)` with `${FACILITY} == "user"`

  * `host("example-host")` with `${HOST} == "example-host"`

  * [`inlist()`](../../docs/axosyslog-core/chapter-routing-filters/filters/reference-filters/filter-inlist/index.md) with the [`in` list membership operator](../../docs/axosyslog-core/filterx/operator-reference/index.md#list-membership-operator)

  * `level(warning)` with `${LEVEL} == "warning"`

If you want to check for a range of levels, use numerical comparison with the `${LEVEL_NUM}` macro instead. For a list of numerical level values, see [LEVEL_NUM](../../docs/axosyslog-core/chapter-manipulating-messages/customizing-message-format/reference-macros/index.md#macro-level-num).

  * `message("example")` with `${MESSAGE} =~ "example"` (see the [equal tilde operator](../../docs/axosyslog-core/filterx/operator-reference/index.md#regexp) for details)

  * [`netmask()`](../../docs/axosyslog-core/chapter-routing-filters/filters/reference-filters/filter-netmask/index.md) and [`netmask6()`](../../docs/axosyslog-core/chapter-routing-filters/filters/reference-filters/filter-netmask6/index.md) with `subnet` and a list membership check, for example, `netmask(192.168.5.0/255.255.255.0)` becomes `${SOURCEIP} in subnet("192.168.5.0/255.255.255.0");`. For details, see [IP addresses and subnets](../../docs/axosyslog-core/filterx/filterx-subnet/index.md).

  * `program(nginx)` with `${PROGRAM} == "nginx"`

  * `source(my-source)` with `${SOURCE} == "my-source"`




You can [compare values](../../docs/axosyslog-core/filterx/filterx-comparing/index.md) and use [boolean operators](../../docs/axosyslog-core/filterx/filterx-boolean/index.md) similarly to filters.

Since all FilterX statements must match a message to pass the FilterX block, you can often replace complex boolean filter expressions with multiple, simple FilterX statements. For example, consider the following filter statement:
```
 
    filter { host("example1") and program("nginx"); };
    
```

The following is the same FilterX statement:
```
 
    filterx { ${HOST} == "example1" and ${PROGRAM} == "nginx"; };
    
```

which is equivalent to:
```
 
    filterx {
        ${HOST} == "example1";
        ${PROGRAM} == "nginx";
    };
    
```

The following filter functions have no equivalents in FilterX yet:

  * The [`filter()` filter function](../../docs/axosyslog-core/chapter-routing-filters/filters/reference-filters/filter-filter/index.md). You can’t call a FilterX block from another FilterX block, but you can [access name-value pairs and pass variables](../../docs/axosyslog-core/filterx/update-filters/index.md#scoping) from multiple FilterX blocks.
  * [`rate-limit()`](../../docs/axosyslog-core/chapter-routing-filters/filters/reference-filters/filter-rate-limit/index.md)
  * [`tags()`](../../docs/axosyslog-core/chapter-routing-filters/filters/reference-filters/filter-tags/index.md)



## Update rewrite rules

This section shows you how to update your existing `rewrite` expressions to `filterx`.

You can replace most [rewrite rules](../../docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/index.md) with FilterX functions and value assignments, for example:

  * `rewrite{subst()}` with the [`regexp_subst` FilterX function](../../docs/axosyslog-core/filterx/function-reference/index.md#regexp-subst)
  * `rewrite{set()}` with [value assignments](../../docs/axosyslog-core/filterx/index.md#assign-values)
  * `rewrite{unset()}` with the [`unset` FilterX function](../../docs/axosyslog-core/filterx/function-reference/index.md#unset)
  * `rewrite{rename()}` with assigning a value to the new field, then using the [`unset`](../../docs/axosyslog-core/filterx/function-reference/index.md#unset) function on the old field
  * [Timezone manipulation](../../docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/rewrite-timezone/index.md) with the similar [FilterX functions](../../docs/axosyslog-core/filterx/filterx-timezone/index.md).



Last modified April 28, 2026: [How to update netmask filter to filterx (c24b76b5)](<https://github.com/axoflow/axosyslog-core-docs/commit/c24b76b59e16f354f84f9656835ca129ae089e07>)