Filtered logspaces allow you to create a smaller, filtered subset of the logs contained in an existing local, remote or multiple logspace. Assigning a user group to a filtered logspace enables fine grained access control by creating a group which sees only a subset of the logs from a logspace.
You can use the same search expressions and logic as on the Search interface to create a filtered logspace. In the following example, we have configured a filtered logspace that only contains messages from syslog-ng:
The filtered logspace is only a view of the base logspace. The log messages are still stored in the base logspace (if the base logspace is a remote logspace, the log messages are stored on the remote syslog-ng Store Box (SSB) application). Therefore, you cannot alter any configuration parameters of the logspace directly. To do this, navigate to the base logspace itself.
Figure 109: Log > Filtered Logspaces — Filtered logspaces
To create filtered logspaces
Navigate to Log > Filtered Logspaces and click .
Enter a name for the logspace into the top field. Use descriptive names that help you to identify the source easily. Note that the name of the logspace must begin with a number or a letter.
Choose which logspace to filter in Base logspace.
Enter the search expression in the Filter field.
You can create complex searches using wildcards and boolean expressions. For more information and practical examples, see Using complex search queries.
SSB only indexes the first 59 characters of every name-value pair (parameter). This has two consequences:
If the parameter is longer than 59 characters, an exact search might deliver multiple, imprecise results.
Consider the following example. If the parameter is:
SSB indexes it only as:
This corresponds to the first 59 characters. As a result, searching for:
returns all log messages that contain:
Using wildcards might lead to the omission of certain messages from the search results.
Using the same example as above, searching for the value:
does not return any results (as the 12345 part was not indexed). Instead, you have to search for:
This, as explained above, might find multiple results.
By default, members of the search group can view the stored messages online. Use the Access control option to control which usergroups can access the logspace. For details, see also Managing user rights and usergroups.