Kubernetes and OpenShift individual subsystem installations

Define ingestion filters to customize API event data before it is stored or offloaded.

1. Edit your AnalyticsCluster CR:

   kubectl -n <namespace> edit a7s

2. Filters for API events that are offloaded to a third-party system are defined in the external.offload section. Filters for API events that are stored in the API Connect OpenSearch database are defined in the ingestion section.

   Ingestion filters - for API event data stored by API Connect

   Add the filter definition to the ingestion section:

     ingestion:
       ... 
       filter: |
         if [api_name] == "test-api" {
           mutate {
             remove_field => ["query_string"]
           }
         }

   In this example, a conditional filter is used to apply the change to API event records where the API name is test-api.

   Offload filters - for API event data that is sent to a third-party system.

   Add the filter definition to the external.offload section:

     external:
       offload:
         filter: |
           mutate {
             remove_field => ["query_string"]
           }

   In this example, no conditional filter is used; the change is applied to all APIs.

   For more examples, see Example ingestion filters.

3. Save the changes. Updates to filters take effect after approximately 30 seconds.