Filter your observation data

Next or click any element in the pipeline to jump to it.

In the filter stage, Sensu executes event filters.

The filter stage of the Sensu observability pipeline applies the conditions, triggers, and thresholds you specify in your event filter defintions to the events your checks generate. Event filters give you control over which events continue through your pipeline and become alerts. For example, use the built-in is_incident event filter to allow only high-priority events through your Sensu pipeline and reduce noise for operators.

To tell Sensu which event filters you want to apply, you list them in your pipeline definitions. Sensu compares your observation data in events against the expressions in your event filters to determine whether each event should continue through the pipeline or be removed. Event filters can be inclusive or exclusive, so you can require events to match or not match your filter expressions.

Here’s an example that shows the resource definition for an event filter that would allow handling for only events with the custom entity label "region": "us-west-1":

---
type: EventFilter
api_version: core/v2
metadata:
  name: production_filter
spec:
  action: allow
  expressions:
  - event.entity.labels['region'] == 'us-west-1'

{
  "type": "EventFilter",
  "api_version": "core/v2",
  "metadata": {
    "name": "production_filter"
  },
  "spec": {
    "action": "allow",
    "expressions": [
      "event.entity.labels['region'] == 'us-west-1'"
    ]
  }
}

Sensu applies event filters in the order that they are listed in your pipeline definition. Any events that the filters do not remove from your pipeline will be processed according to your handler configuration.

As soon as an event filter removes an event from your pipeline because it does not meet the conditions, triggers, or thresholds you specified, the Sensu observability pipeline ceases analysis for the event. Sensu will not transform or process events that your event filter removes from your pipeline.

Use Bonsai, the Sensu asset hub, to discover, download, and share Sensu event filter dynamic runtime assets. Read Use assets to install plugins to get started.