Reduce large volumes of low-value events and improve Receiver performance with filter rules.
A filter rule reduces the amount of data that a Receiver parses by diverting or discarding low-value logs. A high volume of low-value events can obscure important information and decrease system performance. You can set rules rule to stop processing (discard the data), log the data to the ELM, send the data for parsing (which might result in an event), and/or generate an internal event (an ESM event). Parsing consumes Receiver resources, so filter out unnecessary data prior to parsing.
Tip
Don't confuse filter rules with parsing rules, data source rules, or view filters.
Data order
Filter rules are written to the Receiver in this data order:
1 | All non "catch-all" rules. | ||
a | stop = true and parse = false and log = false | ||
b | stop = true and parse = true and log = true | ||
c | stop = true and parse = true and log = false | ||
d | stop = true and parse = false and log = true | ||
2 | All "catch-all" rules | ||
Rule order
If you have Policy Administrator rights, you can set the order that Filter rules are applied. Run the most specific rules before catch-all rules.