This page describes how to filter events written to Boundary event sinks.

This feature was introduced in Boundary 0.5.0.

Event Filtering

Starting in Boundary 0.5.0, a variety of event types (error, observation, system, etc) are emitted from Boundary. Boundary events can be emitted in several formats including cloudevents and hclog, and can be encoded as text and json.

Boundary allows you to configure any number of sinks, where these events will be written. When configuring an event sink, you can specify common sink parameters which include both allow_filters and deny_filters which use the standard filter syntax used elsewhere in Boundary.

Example events encoded as cloudevents-text. The first event is a system event and the second event is an observation event.

  1. {
  2.   "id": "DU7u227Jhc",
  3.   "source": "https://hashicorp.com/boundary/dev-controller/boundary-dev",
  4.   "specversion": "1.0",
  5.   "type": "system",
  6.   "data": {
  7.     "version": "v0.1",
  8.     "op": "worker.(Worker).createClientConn",
  9.     "data": {
  10.       "address": "127.0.0.1:9201",
  11.       "msg": "connected to controller"
  12.     }
  13.   },
  14.   "datacontentype": "text/plain",
  15.   "time": "2021-08-05T18:00:05.303435-04:00"
  16. }
  17. {
  18.   "id": "s5ESg6CckX",
  19.   "source": "https://hashicorp.com/boundary/dev-controller/boundary-dev",
  20.   "specversion": "1.0",
  21.   "type": "observation",
  22.   "data": {
  23.     "latency-ms": 202.995176,
  24.     "request_info": {
  25.       "id": "gtraceid_WiLnGzc2UHmNAYlcQ0sK",
  26.       "method": "POST",
  27.       "path": "/v1/auth-methods/ampw_1234567890:authenticate"
  28.     },
  29.     "start": "2021-08-05T18:00:34.032333-04:00",
  30.     "status": 200,
  31.     "stop": "2021-08-05T18:00:34.235335-04:00",
  32.     "version": "v0.1"
  33.   },
  34.   "datacontentype": "text/plain",
  35.   "time": "2021-08-05T18:00:34.235357-04:00"
  36. }
  1. {  "id": "DU7u227Jhc",  "source": "https://hashicorp.com/boundary/dev-controller/boundary-dev",  "specversion": "1.0",  "type": "system",  "data": {    "version": "v0.1",    "op": "worker.(Worker).createClientConn",    "data": {      "address": "127.0.0.1:9201",      "msg": "connected to controller"    }  },  "datacontentype": "text/plain",  "time": "2021-08-05T18:00:05.303435-04:00"}{  "id": "s5ESg6CckX",  "source": "https://hashicorp.com/boundary/dev-controller/boundary-dev",  "specversion": "1.0",  "type": "observation",  "data": {    "latency-ms": 202.995176,    "request_info": {      "id": "gtraceid_WiLnGzc2UHmNAYlcQ0sK",      "method": "POST",      "path": "/v1/auth-methods/ampw_1234567890:authenticate"    },    "start": "2021-08-05T18:00:34.032333-04:00",    "status": 200,    "stop": "2021-08-05T18:00:34.235335-04:00",    "version": "v0.1"  },  "datacontentype": "text/plain",  "time": "2021-08-05T18:00:34.235357-04:00"}

If I wanted to filter an event sink which was configured for every event type to only include the above events, I might use the following sink configuration:

  1. sink "stderr" = {
  2.     name = "all-events"
  3.     description = "All events sent to stderr"
  4.     event_types = ["*"]
  5.     format = "cloudevents-text"
  6.     allow_filters = [
  7.         '"/Data/request_info/Path" contains ":authenticate"'
  8.         '"/Data/Op" contains ".createClientConn"'
  9.     ]
  10.     # note: deny_filters are also supported.
  11. }
  1. sink "stderr" = {    name = "all-events"    description = "All events sent to stderr"    event_types = ["*"]    format = "cloudevents-text"    allow_filters = [        '"/Data/request_info/Path" contains ":authenticate"'        '"/Data/Op" contains ".createClientConn"'    ]    # note: deny_filters are also supported.}

When running boundary dev the example allow filter can be given via:

  1. boundary dev \
  2.     -event-allow-filter '"/Data/request_info/Path" contains ":authenticate"' \
  3.     -event-allow-filter '"/Data/Op" contains ".createClientConn"'
  1. boundary dev \    -event-allow-filter '"/Data/request_info/Path" contains ":authenticate"' \    -event-allow-filter '"/Data/Op" contains ".createClientConn"'

Double quotes are part of the filter syntax; when using the CLI, it is likely easier to surround the filter with single quotes than to deal with escaping double quotes.

Both -event-allow-filter and -event-deny-filter command flags are supported for the boundary dev command.