From d93ccc7387bc8f413830077ec3a6be002ff8c395 Mon Sep 17 00:00:00 2001 From: Karl Fleischmann Date: Wed, 2 Nov 2022 16:32:59 +0100 Subject: [PATCH] configuration_manual/event_filter: Add section regarding size comparisons using units --- source/configuration_manual/event_filter.rst | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/source/configuration_manual/event_filter.rst b/source/configuration_manual/event_filter.rst index f14276b9a0..3a51116b54 100644 --- a/source/configuration_manual/event_filter.rst +++ b/source/configuration_manual/event_filter.rst @@ -92,6 +92,17 @@ A more complicated example:: event=abc OR (event=def AND (category=imap OR category=lmtp) AND \ NOT category=debug AND NOT (bytes_in<1024 OR bytes_out<1024)) +.. versionadded:: v3.0.0 + +Sizes can now also be expressed using the unit values ``B`` - which represents +single byte values - as well as ``K``, ``M``, ``G`` and ``T`` which are all +powers of 1024. + +For example:: + + (category=debug AND NOT (bytes_in<1K OR bytes_out<1K)) OR \ + (event=abc AND (message_size>1G and message_size<1T)) + .. _event_filter_metric: Metric filter syntax