Learn how to write proxy preprocessor rules that include conditions.

You can configure Wavefront proxies with preprocessor rules that apply only when multiple conditions are met or when certain conditions are met and other conditions are not met.

Conditional Preprocessor Rule Example

For example, you might want to block spans only if the following conditions are met:

  • Has span tags that match both "span.kind"="server" and ("http.status_code"="302" or "http.status_code"="404").
  • Has no span tags that match debug=true.

You can use the if parameter to fine-tune when a rule applies. Here are the rules for the example above.

## drop spans that match the following:
## "span.kind"="server" and ("http.status_code"="302" or "http.status_code"="404") and "debug"!="true"
'2878':
    - rule: test-block-list
    action: spanBlock
    if: >
      {{http.status_code}} in ("302", "404") and {{span.kind}} = "server"
      and not {{debug}} = "true"

The if parameter is always followed by just one operator, one of the following:

  • Comparison operators with scope and value for each.
  • Logical operators followed by comparison operators with scope and value for each.

Comparison Operators

With each comparison operator you specify the scope and the value.

Example

## Block list spans that have a tag "http.status_code"="302" or "http.status_code"="404"
'2878':
  - rule: test-spanblock-list
    action: spanBlock
    if:
      equals:
        scope: http.status_code
        value: ["302, 404"]

Scope

The scope is one of the following:

ScopeDescription
metricName Compares the specified value with the metric name for a point.
sourceName Compares the specified value with the source for a point.
<pointTagKey> Compares the specified value with the value of the specified point tag key for a point.
spanName Compares the specified value with the span name.
<spanTagKey> Compares the specified value with the value of the specified span tag key.

The value can be a string or a list of string values.

Definition

Comparison operators work exactly the way they do in Java.

OperatorDescription
equals Tests if the metricName, sourceName, etc. is equal to the value.
startsWith Tests if the metricName, sourceName, etc. starts with the value.
endsWith Tests if the metricName, sourceName, etc. ends with the value.
contains Tests if the metricName, sourceName, etc. contains the value.
regexMatch Allows you to define a Java regex to match the value.

Logical Operators

Logical operators support nesting in any proxy preprocessor rule. The logical operator always requires comparison operators with a scope and a value, as shown in the following example of nested operators.

In the example below, the rule applies only if at least one of the specified conditions are met:

  • The sourceName has the value prod and a metricName has the value mymetric..
  • The metricName starts with the string mymetric.prod.
  • The env point tag is equal to prod
## Example showing nested predicates: The below rule allows all "prod" metrics.
'2878':
  - rule: test-allow-list
    action: allow
    if:
      any:
        - all:
          - contains:
              scope: sourceName
              value: "prod"
          - startsWith:
              scope: metricName
              value: "mymetric.prod"
          - equals:
              scope: env
              value: "prod"

Here are examples for each logical operator:

OperatorExample
all Rule applies if a point's sourceName contains prod or staging, AND the point's metricName starts with mymetric.: all: - contains: scope: sourceName value: ["prod", "staging"] - startsWith scope: metricName value: "mymetric."
any Rule applies if sourceName contains prod OR metricName starts with mymetric.: any: - contains: scope: sourceName value: "prod" - startsWith scope: metricName value: "mymetric."
none Rule DOES NOT apply if either of the conditions is met. That means either the span’s sourceName contains the substring prod or the spanName starts with dev. none: - contains: scope: sourceName value: “prod” - endsWith scope: spanName value: "dev."
ignore This operator doesn't have an effect but can be used to temporarily disable a section of the rule. ignore: - contains: scope: debug value: “true”