From c1c0af282c2ce866a392d7c72bd3e7a28c13d12a Mon Sep 17 00:00:00 2001 From: Karl Fleischmann Date: Wed, 2 Nov 2022 16:32:59 +0100 Subject: [PATCH] configuration_manual/event_filter: Add section regarding size comparisons using units --- source/configuration_manual/event_filter.rst | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/source/configuration_manual/event_filter.rst b/source/configuration_manual/event_filter.rst index f14276b9a..e8b1de669 100644 --- a/source/configuration_manual/event_filter.rst +++ b/source/configuration_manual/event_filter.rst @@ -92,6 +92,16 @@ A more complicated example:: event=abc OR (event=def AND (category=imap OR category=lmtp) AND \ NOT category=debug AND NOT (bytes_in<1024 OR bytes_out<1024)) +.. versionadded:: v2.4.0;v3.0.0 Sizes can be expressed using the unit values + ``B`` - which represents single byte values - as well as ``K``, ``M``, ``G`` + and ``T`` which are all powers of 1024. If no unit is specified ``B`` is + used by default. + +For example:: + + (category=debug AND NOT (bytes_in<1K OR bytes_out<1K)) OR \ + (event=abc AND (message_size>1G and message_size<1T)) + .. _event_filter_metric: Metric filter syntax