Skip to main content
Chronosphere Observability Platform provides control rules that let you manage log data by transforming, reshaping, retaining, or excluding data before it’s stored. These rules let you control the volume of persisted log data and improve data quality. By controlling which data you keep or drop, you can reduce noise, better control costs, and focus on data that matters most to your business. Observability Platform offers the following control rules:
  • Drop logs that match a specific filter to remove unnecessary or low-value data.
  • Drop fields from logs that match specified conditions, which helps reduce the size of individual logs. If a log contains no data after fields are dropped, you can choose to drop the entire log.
  • Sample logs to retain a certain percentage of matching logs and drop the remainder, which can significantly reduce volume and maintain visibility.
  • Emit metric converts log data to metric data. Use this control rule when you want to reduce the volume of logs, retain data for a longer period, and increase the speed of querying and filtering for metrics instead of logs.
  • Replace field identifies a specified field in your log data and uses a regular expression to replace any matches based on the selected replacement mode. Use this control rule to truncate long fields and preserve your log structure.
Control rules run after parsers and field mappings, and are applied in descending order. Disabled rules are skipped. Enable rules to have Observability Platform evaluate them. To change the order that control rules are applied, reorder rules.

​
View control rules

Select from one of the following methods to view control rules.
To view control rules:
  1. In the navigation menu, click Go to Admin and then select Control > Logs Ingest. All defined control rules display in the Control rules section.
  2. To view only control rules, from the View dropdown, select Control rules.
  3. To view the code definition for all configured control rules, click the Code config tab. The Logs control rules section includes all defined control rules.

​
Create control rules

Use control rules to drop certain logs at ingestion, or fields that you don’t want to persist. For example, dropping log data from a specific cluster, test data in a development environment, or unnecessary individual fields across your logs. Use one of the following methods to create control rules for log data:
Define control rules in Observability Platform, and then use the Code Config tool to apply the rule definition.
  1. In the navigation menu, click Go to Admin and then select Control > Logs Ingest.
  2. In the Control rules section, click Create.
  3. In the Create control rule page, enter a name for the control rule.
  4. From the Action menu, select the type of rule to create:
    • Drop logs: Completely drop logs that match the specified filter.
    • Drop fields: Remove specific fields from logs that match the specified filter.
    • Sample logs: Retain a certain percentage of matching logs and drop the remainder.
    • Emit metric: Convert log data to metric data.
    • Replace field: Replace context within a log field using a regular expression.
  5. Enter a filter to return log data for the control rule, and then press Ctrl+Enter (Command+Return on macOS) to submit the filter. This rule applies only to logs that match this filter at the time the log data was ingested.
  6. Review the returned data from the preview filter and make changes as necessary.
    Control rules are applied during ingestion, so the preview filter results might differ from a filter submitted in Logs Explorer after ingestion. By default, including a dot (.) in a filter indicates nesting within a field.In some instances, fields with a key that uses dot notation within the name, such as resource.type, must be surrounded by double quotes and brackets in the control rule filter.If a warning message displays indicating that This filter is applied at ingestion and the filter returns no results, wrap the key in double quotes ( ") and brackets ([]). For example, the following filter contains the resource.type key, which requires surrounding the field in double quotes and brackets for this particular service:
    service = "nginx" and severity = "INFO" and ["resource.type"] = "k8s_container"
  7. Enter additional information for the specified action:
    Review the filter and make changes as needed.
  8. Click Save to save the control rule definition.
  9. Click the Code config tab and use the Code Config tool to apply the definition.

​
Chronoctl example

The following example defines a control rules file for Chronoctl, and contains the following rules:
  • The first rule samples 10% of logs that match the defined filter.
  • The second rule drops all logs for the nginx service of severity INFO where the http.Request.status equals 200.
  • The third rule drops all kubernetes fields that match the defined filter. The regular expression indicates that any fields matching kubernetes.[FIELD] are dropped from all logs.
  • The fourth rule uses a mapped value to search for the error_code field, and replaces values based on the provided key/value pairs. If the rule matches on INTERNAL_SERVER_ERROR, it replaces that value with 500. If the rule matches on NOT_FOUND, it replaces the value with 401.
api_version: v1/config
kind: LogControlConfig
spec:
  # The ordered list of control rules.
  rules:
    - name: "Sample billing service with missing user ID"
      mode: ENABLED
      # Log filter syntax to select logs. Only matching logs will have control action applied.
      filter: "cluster_name:'production'\n
              AND service='billing-service'\n
              AND message = 'missing user ID'"
      type: SAMPLE
      sample:
        # Percentage of matching logs to keep. Must be in the range [0, 1].
        rate: 0.10
    - name: "Drop NGINX information logs"
      mode: ENABLED
      filter: "service = 'nginx' and severity = 'INFO' and httpRequest.status = '200'"
      type: DROP
    - name: 'Drop Kubernetes fields from development environments'
      mode: ENABLED
      filter: "namespace = 'development' and kubernetes.cluster_name = 'test'"
      # The configuration for a drop field action.
      type: DROP_FIELD
      drop_field:
        # Regular expression to match the field names to drop.
        field_regex: .*
        # Selector to indicate field path. Use 'parent[child]' syntax to
        # indicate nesting.
        parent_path:
          selector: kubernetes
    - name: error replacement
      mode: ENABLED
      filter: service = "nginx" and severity = "ERROR"
      type: REPLACE_FIELD
      replace_field:
        field:
          selector: error_code
        replace_regex: .*
        replace_all: true
        replace_mode: MAPPED_VALUE
        mapped_value:
          pairs:
            - key: INTERNAL_SERVER_ERROR
              value: "500"
            - key: NOT_FOUND
              value: "401"

​
Terraform example

The following example defines a control rules resource for Terraform, and contains the following rules:
  • The first rule samples 10% of logs that match the defined filter.
  • The second rule drops all logs for the nginx service of severity INFO where the http.Request.status equals 200.
  • The third rule drops all kubernetes fields that match the defined filter. The regular expression indicates that any fields matching kubernetes.[FIELD] are dropped from all logs.
  • The fourth rule uses a mapped value to search for the error_code field, and replaces values based on the provided key/value pairs. If the rule matches on INTERNAL_SERVER_ERROR, it replaces that value with 500. If the rule matches on NOT_FOUND, it replaces the value with 401.
resource "chronosphere_log_control_config" "log_control_config" {
  # The ordered list of control rules.
  rules {
    name   = "Sample billing service with missing user ID"
    # Log filter syntax to select logs. Only matching logs will have control action applied.
    filter = chomp(<<-EOF
    cluster_name:"rc"
    AND service="billing-service"
    AND message = "missing user ID"
    EOF
    )
    mode = "ENABLED"

    sample {
      # Percentage of matching logs to keep. Must be in the range [0, 1].
      rate = 0.01
    }
    # The configuration for a drop field action.
    type = "SAMPLE"
  }

  rules {
    name   = "Drop NGINX information logs"
    filter = "service = \"nginx\" and severity = \"INFO\" and httpRequest.status = \"200\""
    mode   = "ENABLED"
    type   = "DROP"
  }

  rules {
    name = "Drop Kubernetes fields from development environments"

    drop_field {
      # Regular expression to match the field names to drop.
      field_regex = ".*"
      # Selector to indicate field path. Use 'parent[child]' syntax to
      # indicate nesting.
      parent_path {
        selector = "kubernetes"
      }
    }

    filter = "chronosphere_namespace = \"rc-logging\" and kubernetes.cluster_name = \"rc-b\""
    mode   = "ENABLED"
    type   = "DROP_FIELD"
  }

  rules {
    name   = "error replacement"
    filter = "service = \"nginx\" and severity = \"ERROR\""
    mode   = "ENABLED"

    replace_field {
      field {
        selector = "error_code"
      }

      mapped_value {
        pairs {
          key   = "INTERNAL_SERVER_ERROR"
          value = "500"
        }

        pairs {
          key   = "NOT_FOUND"
          value = "401"
        }
      }

      replace_all   = true
      replace_mode  = "MAPPED_VALUE"
      replace_regex = ".*"
    }

    type = "REPLACE_FIELD"
  }
}

​
Edit control rules

When creating or editing control rules, you can use the Code Config tool to view code representations of the rules. The displayed code also responds to changes you make in the Visual editor tab. Select from the following methods to edit control rules.
  1. In the navigation menu, click Go to Admin and then select Control > Logs Ingest.
  2. In the row of the control rule you want to edit, click the three vertical dots icon and then click Edit control rule.
  3. In the Edit control rule drawer, make changes to your control rule, and then click Save.
  4. Click the Code config tab and use the Code Config tool to apply the definition.
Observability Platform saves changes to your control rule.

​
Reorder control rules

Control rules are applied in descending order. To change the order control rules are applied, reorder rules. Disabled rules are skipped.
  1. In the navigation menu, click Go to Admin and then select Control > Logs Ingest.
  2. In the Control rules section, click Re-order rules.
  3. In the Edit control rules drawer, in the row of the control rule you want to move, click the drag indicator icon and move the control rule to a different order position.
  4. Click Save.
  5. Click the Code config tab and use the Code Config tool to apply the definition.
Observability Platform saves changes to your control rules.

​
Enable or disable control rules

Each rule has a mode, which can be enabled or disabled. By default, any created rule is enabled. Any rule that’s enabled is applied. Disabled rules are skipped.
  1. In the navigation menu, click Go to Admin and then select Control > Logs Ingest.
  2. In the row of the control rule you want to enable or disable, click the toggle in the Enabled column.
  3. Click Save.
  4. Click the Code config tab and use the Code Config tool to apply the definition.
Observability Platform saves changes to your control rules.

​
Delete control rules

Select from the following methods to delete control rules.
  1. In the navigation menu, click Go to Admin and then select Control > Logs Ingest.
  2. In the row of the control rule you want to delete, click the three vertical dots icon and then click Delete control rule.
  3. Click the Code config tab and use the Code Config tool to apply the definition.
Observability Platform deletes your control rule.