Configuring and debugging the free-style filter

Free-style filters allow users to define a filter for logs that are captured to each individual logging device type. Filters can include log categories and specific log fields. The filters can be created as an inclusive list or exclusive list.

Free-style filters can also be used to filter logs that have been captured on logging devices already to narrow down the list of logs to view.

config log syslogd filter
    config free-style
        edit <id>
            set category <option>
            set filter <string>
            set filter-type {include | exclude}
        next
    end
end

category <option>	Set the log category. The following options are available: traffic, event, virus, webfilter, attack, spam, anomaly, voip, dlp, app-ctrl, waf, dns, ssh, ssl, file-filter, icap, and ztna.
filter <string>	Enter the filter criteria. Multiple values can be added, for example: set filter "logid <id> <id>"
filter-type {include | exclude}	Include/exclude logs that match the filter.

Use the following commands to view the results when multiple fields are used:

# execute log filter free-style "logid <id> <id>"

# execute log filter free-style "srcip <IP_address> <IP_address>"

# execute log filter free-style "(logid <id>) or (srcip <IP_address> <IP_address>)"

# execute log filter free-style "(srcip <IP_address>) and (dstip <IP_address>)"

In this example, the free-style filter is set to filter log IDs 0102043039 and 0102043040. The source IPs, 192.168.2.5 and 192.168.2.205, are also checked.

To configure the syslogd free-style filter with multiple values:

config log syslogd filter
    config free-style
        edit 1
            set category event
            set filter "logid 0102043039 0102043040"
        next
    end
end

To view the syslogd free-style filter results:

# execute log filter free-style "logid 0102043039 0102043040"
# execute log filter dump
category: event
device: disk
start-line: 1
view-lines: 10
max-checklines: 0
HA member:
log search mode: on-demand
pre-fetch-pages: 2
Filter: logid 0102043039 0102043040
Oftp search string: (and (or logid=="0102043039" not-exact logid=="0102043040" not-exact))

# execute log filter free-style "(logid 0102043039) or (srcip 192.168.2.5 192.168.2.205)"
# execute log filter dump
category: event
device: disk
start-line: 1
view-lines: 10
max-checklines: 0
HA member:
log search mode: on-demand
pre-fetch-pages: 2
Filter: (logid 0102043039) or (srcip 192.168.2.5 192.168.2.205)
Oftp search string: (or (or (or srcip==192.168.2.5) (or srcip==192.168.2.205)) (or logid=="0102043039" not-exact))