Drop noisy logs

Health-check probes (/healthz, /health, /ping) dwarf real traffic in most log streams. They cost storage at your destination, dilute search results, and tell you nothing useful. Dropping them before they leave the collector is a one-step pipeline change.

Pipeline filter vs route filter

A Filter step drops records where its expression is true. A route input filter does the opposite — it keeps records where the expression is true. Use a Filter step to shed noise inside a pipeline; use a route filter to decide which records a route accepts in the first place.

What you’ll do

1. Add a Filter step to a pipeline with an OTTL match expression.
2. Verify with the dry-run panel that the unwanted records disappear.
3. Save + attach the pipeline to a route on the collector receiving the noisy source.

1. Add a Filter step

Open the pipeline you want to clean up (or create a new one — see Build your first pipeline for the chain-editor walkthrough). Click + Add Processor.

The processor picker. Pick 'Drop Health Check Logs' for the canned recipe, or 'Filter (custom)' to write the match expression yourself.

Use the pre-baked Drop Health Check Logs template for the common case (it drops /healthz, /healthy, /ready, /live paths typical of Kubernetes probes). For other patterns, pick Filter (custom) and write an OTTL expression in the rule builder:

IsMatch(body, "GET /health")

Anything matching the expression is dropped before the next processor sees it.

2. Dry-run against a sample

Open the dry-run panel and paste a sample with a mix of records you want to drop and records you want to keep:

{
  "resourceLogs": [{
    "scopeLogs": [{
      "logRecords": [
        {"body": {"stringValue": "GET /health HTTP/1.1 200"}},
        {"body": {"stringValue": "POST /api/v1/orders HTTP/1.1 201"}}
      ]
    }]
  }]
}

Click Run. The Final Output panel shows only the /api/v1/orders record — /health was filtered out.

Per-step diff after running the filter. The dropped record disappears from the Final Output; the kept one passes through unchanged.

3. Verify on a live collector

Save the pipeline and attach it via a route on the collector that owns the noisy source. Within a few seconds the change is live.

Watch the per-stream throughput counters on the collector detail page: the route’s input rate stays the same (records still arrive), but the output rate drops by however much noise you filtered. The delta is your savings.

Related

• Pipeline — the recipe-vs-route distinction
• Build your first pipeline — full walkthrough including dry-run + route attach
• Mask PII — the same Transform-vs-Filter choice applied to redaction