diff --git a/docs/references/parsers.md b/docs/references/parsers.md index 0a4638ff0..7f028eea1 100644 --- a/docs/references/parsers.md +++ b/docs/references/parsers.md @@ -151,10 +151,14 @@ It is meant to help understanding parser node behaviour by providing contextual filter: expression ``` -`filter` must be a valid {{expr.htmlname}} expression that will be evaluated against the {{event.name}}. +`filter` must be a valid {{expr.htmlname}} expression that will be evaluated against the {{event.htmlname}}. + If `filter` evaluation returns true or is absent, node will be processed. + If `filter` returns `false` or a non-boolean, node won't be processed. +Here is the [expr documentation](https://github.com/antonmedv/expr/tree/master/docs). + Examples : - `filter: "evt.Meta.foo == 'test'"` diff --git a/docs/references/scenarios.md b/docs/references/scenarios.md index 01c13bfef..311bb5c76 100644 --- a/docs/references/scenarios.md +++ b/docs/references/scenarios.md @@ -87,12 +87,16 @@ The name must be unique (and will define the scenario's name in the hub), and th ### filter ```yaml -filter: evt.Meta.log_type == 'telnet_new_session' +filter: expression ``` +`filter` must be a valid {{expr.htmlname}} expression that will be evaluated against the {{event.htmlname}}. -an {{expr.htmlname}} that must return true if the event is eligible for the bucket. +If `filter` evaluation returns true or is absent, event will be pour in the bucket. +If `filter` returns `false` or a non-boolean, the event will be skip for this bucket. + +Here is the [expr documentation](https://github.com/antonmedv/expr/tree/master/docs). Examples :