Filter responses with sensuctl

Sensuctl supports response filtering for all commands using the list verb. For information about response filtering methods and available label and field selectors, read API response filtering.

Sensuctl-specific syntax

You can use the same methods, selectors, and examples for sensuctl response filtering as for API response filtering, except you’ll format your requests with the --label-selector and --field-selector flags instead of cURL.

The standard sensuctl response filtering syntax is:

sensuctl <resource_type> list --<selector> '<filter_statement>'

To create a sensuctl response filtering command:

• Replace <resource_type> with the resource your filter is based on.
• Replace <selector> with either label-selector or field-selector, depending on which selector you want to use.
• Replace <filter_statement> with the filter to apply.

For example:

sensuctl event list --field-selector 'linux notin event.entity.subscriptions'

Sensuctl response filtering commands will also work with a single equals sign between the selector flag and the filter statement:

sensuctl event list --field-selector='linux notin event.entity.subscriptions'

The examples demonstrate how to construct sensuctl filter statements for different selectors and operators.

Filter operators

Sensuctl response filtering supports two equality-based operators, two set-based operators, one substring matching operator, and one logical operator.

For details about operators, read about the API response filtering operators.

Examples

Filter responses with label selectors

Use the --label-selector flag to filter responses using custom labels.

For example, to return entities with the proxy_type label set to switch:

sensuctl entity list --label-selector 'proxy_type == switch'

Filter responses with field selectors

Use the --field-selector flag to filter responses using specific resource attributes.

For example, to return entities with the switches subscription:

sensuctl entity list --field-selector 'switches in entity.subscriptions'

To retrieve all events that equal a status of 2 (CRITICAL):

sensuctl event list --field-selector 'event.check.status == "2"'

To retrieve all entities whose name includes the substring webserver:

sensuctl entity list --field-selector 'entity.name matches "webserver"'

Use the logical AND operator

To use the logical AND operator (&&) to return checks that include a linux subscription in the dev namespace:

sensuctl check list --field-selector 'linux in check.subscriptions && dev in check.namespace'

Combine label and field selectors

You can combine the --label-selector and --field-selector flags in a single command.

For example, this command returns checks with the region label set to us-west-1 that also use the slack handler:

sensuctl check list --label-selector 'region == "us-west-1"' --field-selector 'slack in check.handlers'