Ingestion Rules

Filter and sample logs before they are stored — reduce volume, cost, and noise.

Overview

Ingestion rules are evaluated at write time, before logs are stored in ClickHouse. Rules are processed in priority order (lowest number first). Go to Ingestion in the sidebar to manage rules.

Rule types

Drop

Permanently discards logs matching the pattern. Use to eliminate noise from health checks, readiness probes, or chatty dependencies.

json

{
  "type": "drop",
  "match": { "message": "GET /health" }
}

Sample

Keeps only a percentage of matching logs. Useful for high-volume info logs where you don't need every occurrence.

json

{
  "type": "sample",
  "match": { "level": "info", "service": "api-gateway" },
  "config": { "sampleRate": 0.1 }
}

A sampleRate of 0.1 keeps 10% of matching logs randomly.

Match criteria

message — substring match in the log message
level — exact level match (info, warn, error, etc.)
service — exact service name match
host — exact host match

⚠️

Dropped logs are gone permanently — they won't appear in search or alerts. Test your rules carefully before enabling on production.

Common patterns

json

// Drop Kubernetes health probes
{ "type": "drop", "match": { "message": "kube-probe" } }

// Keep only 5% of debug logs
{ "type": "sample", "match": { "level": "debug" }, "config": { "sampleRate": 0.05 } }

// Drop all logs from a noisy service
{ "type": "drop", "match": { "service": "metrics-exporter" } }

API Reference

PII Masking