Filtering & Dropping

Last updated 9 days ago

Filter & drop noisy logs

Timber offers the ability to filter and drop logs. This is great for noisy, low value logs, such as health check logs that you otherwise do not need.

This feature is currently in beta and is being actively improved as we receive feedback.

Getting Started

Filtering within the Timber web app is not currently available, but it is available through our API. Because this is such a simple feature, the instruction below use the Timber API directly.

In your shell issue the following curl command:

curl https://api.timber.io/log_filters \
-s \
-X POST \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '
{
"organization_id": "YOUR_ORGANIZATION_ID",
"name":"FILTER_NAME",
"match":"MATCH",
"source_ids": ["SOURCE_ID"]
}
' \
| jq

Usage

Adding

Please see the Getting Started guide.

Listing

You can list your current log filters with a simply curl command:

curl https://api.timber.io/log_filters \
-s \
-H "Authorization: Bearer YOUR_API_KEY" \
| jq

Disabling

Simply remove all application_ids from your log filter:

curl https://api.timber.io/log_filters/ID \
-s \
-X PUT \
-H "Authorization: Bearer YOUR_API_KEY" \
-d '{"source_ids": []}' \
| jq

Removing

You can remove a log filter in the same way you added it, through curl:

  • Replace YOUR_API_KEY with your actual API key.

  • Replace ID with the ID of your log filter.

curl https://api.timber.io/log_filters/ID \
-s \
-X DELETE \
-H "Authorization: Bearer YOUR_API_KEY" \
| jq

Fields

name

The name of your log filter. This should be a short, descriptive name for humans.

match

The sub-string to match in your logs. If your logs contain this sub-string in the message field then it will be dropped. See How It Works below.

How It Works

Substring matching

Your logs contains a variety of fields, and the "message" field is what contains the actual log message. This is the value we apply your match value against to determine if it should be dropped.

Case Insensitive

Your match value is case insensitive. Any log that contains the match sub-string will be dropped regardless of it's case.

Example

Given these log lines:

{"message": "Hello world"}
{"message": "A log line message"}
{"message": "I said hello world"}
{"message": "Hello universe"}

And a match value of "hello world" . The result should be:

{"message": "A log line message"}
{"message": "I said hello world"}

Lines 1 and 4 were dropped because they both contained the "hello world" substring.

FAQs

Will I be charged for filtered / dropped logs?

No. Logs are dropped before they are counted towards your billing.

Why do you recommend dropping logs at the source?

It is much more efficient and alleviates your app from having to send the logs at all. If possible, we recommend not sending the log at all. In some cases this is not possible, such as logs generated by a hosted platform, and this is a great use case for filtering on the Timber side.

Can I drop logs based the value of an attribute?

Not yet. Log filtering is currently in beta and the first version shipped with sub-string matching only. We plan to add more options around matching and filtering in the future.

Can I drop logs with regex?

Not yet. Log filtering is currently in beta and the first version shipped with sub-string matching only. We plan to add more options around matching and filtering in the future.

What else can I do to reduce log volume?

Checkout our Reducing Log Volume guide.

‚Äč