Learn how to add conditions on Wavefront proxy preprocessor rules.

You can set up your environment to apply a proxy preprocessor rule only when multiple conditions are met or when certain conditions are met and other conditions are not met.

Example

For example, you might want to block list spans only if it

  • has span tags that match both "span.kind"="server" and ("http.status_code"="302" or "http.status_code"="404")
  • and has no span tags that match debug=true

You can use the if parameter to fine-tune when a rule applies. For the example above, you can create a rule like this:

## drop spans that match the following:
## "span.kind"="server" and ("http.status_code"="302" or "http.status_code"="404")
'2878':
  - rule: test-block-list
    action: spanBlock
    if:
      all:
        - equals:
            scope: http.status_code
            value: ["302, 404"]
        - equals:
            scope: span.kind
            value: "server"
        - none:
          - equals:
              scope: debug
              value: "true"

        

The new format, which is in BETA, is a simpler version on how to use the if parameter to fine-tune when a rule applies.

## drop spans that match the following:
## "span.kind"="server" and ("http.status_code"="302" or "http.status_code"="404")
'2878':
    - rule: test-block-list
      action: spanBlock
      if: >
        {{http.status_code}} in ("302", "404") and {{span.kind}} = "server"
        and not {{debug}} = "true"
    

The if parameter is always followed by just one operator, one of the following:

  • Comparison operators with scope and value for each.
  • Logical operators followed by comparison operators with scope and value for each.

Comparison Operators

With each comparison operator you specify the scope and the value.

Example

## Block list spans that have a tag "http.status_code"="302" or "http.status_code"="404"
'2878':
  - rule: test-spanblock-list
    action: spanBlock
    if:
      equals:
        scope: http.status_code
        value: ["302, 404"]

Scope

The scope is one of the following:

ScopeDescription
metricName Compares the specified value with the metric name for a point.
sourceName Compares the specified value with the source for a point.
<pointTagKey> Compares the specified value with the value of the specified point tag key for a point.
spanName Compares the specified value with the span name.
<spanTagKey> Compares the specified value with the value of the specified span tag key.

The value can be a string or a list of string values.

Definition

Comparison operators work exactly the way they do in Java.

OperatorDescription
equals Tests if the metricName, sourceName, etc. is equal to the value.
startsWith Tests if the metricName, sourceName, etc. starts with the value.
endsWith Tests if the metricName, sourceName, etc. ends with the value.
contains Tests if the metricName, sourceName, etc. contains the value.
regexMatch Allows you to define a Java regex to match the value.

Logical Operators

Logical operators support nesting in any proxy preprocessor rule. The logical operator always requires comparison operators with a scope and a value, as shown in the following example of nested operators.

In the example below, the rule applies only if at least one of the specified conditions are met:

  • The sourceName has the value prod and a metricName has the value mymetric..
  • The metricName starts with the string mymetric.prod.
  • The env point tag is equal to prod
## Example showing nested predicates: The below rule allows all "prod" metrics.
'2878':
  - rule: test-allow-list
    action: allow
    if:
      any:
        - all:
          - contains:
              scope: sourceName
              value: "prod"
          - startsWith
              scope: metricName
              value: "mymetric."
        - startsWith:
            scope: metricName
            value: "mymetric.prod."
        - equals:
            scope: env
            value: "prod"

Here are examples for each logical operator:

OperatorExample
all Rule applies if a point's sourceName contains prod or staging, AND the point's metricName starts with mymetric.: all: - contains: scope: sourceName value: ["prod", "staging"] - startsWith scope: metricName value: "mymetric."
any Rule applies if sourceName contains prod OR metricName starts with mymetric.: any: - contains: scope: sourceName value: "prod" - startsWith scope: metricName value: "mymetric."
none Rule DOES NOT apply if either of the conditions is met. That means either the span’s sourceName contains the substring prod or the spanName starts with dev. none: - contains: scope: sourceName value: “prod” - endsWith scope: spanName value: "dev."
ignore This operator doesn't have an effect but can be used to temporarily disable a section of the rule. ignore: - contains: scope: debug value: “true”