[syslog-ng] how to stop the processing if the filter return true?

6 Dec 2016

      Hi folks,

Basically, in my setup, I received a jSON and the all usual (default)
syslog packets in my server. But, I have a simple filter
"f_blacklist_network_by_clientip" based in a jSON field. everything works
well, the problem is because when my filter
"f_blacklist_network_by_clientip" return OK, the junction() goes to the
next statement processing the d_default_handler() destination.

My doubt is: how to stop the processing when my filter
f_blacklist_network_by_clientip() returns OK?

*<SNIP>*
log {
    source(s_internet);

    junction {
         channel {
            filter(f_wb_access_log);
            parser(p_msg2json);
            filter(f_blacklist_network_by_clientip);
            destination(d_wb_access_log);
            flags(final);
        };

        # Default destination
        channel {
*            # DOUBT: how to don't processing if the
f_blacklist_network_by_clientip return OK?*
            destination(d_default_handler);
        };
    };
};

filter f_wb_access_log {  program("wb_access"); };
parser p_msg2json { json-parser( marker("") prefix("j.")); };

filter f_blacklist_network_by_clientip {
    not match("^127\.0\.", value("j.clientip"));
    not match("^172\.16\.", value("j.clientip"));
    not match("^172\.26\.", value("j.clientip"));
    not match("^172\.31\.", value("j.clientip"));
*    # if match, stop the processing and don't jump to "channel {
destination(d_default_handler); };*
};

destination d_wb_access_log {

file("/var/log/syslog-ng/wb/${j.webapp_domain:-invalid_gw_access}_access.log"
         create_dirs(yes) template("${MSG}\n")
    );
};

destination d_default_handler {

file("/var/log/syslog-ng/servers/${HOST}/${FACILITY:-invalid_facility}.log"
         create_dirs(yes)
    );
};

*</SNIP>*

[syslog-ng] how to stop the processing if the filter return true?

Jorge Pereira