A recent support query on the various filtering options in LogMeister and EventMeister got me thinking it would be helpful to give an overview here.

All filtering in LogMeister / EventMeister is accomplished by building simple logical rules. Once constructed, the rules can be used in several different places – with accordingly different effects:

1. Directly on the feed
   Filter rules used here constrain which log entries are actually collected and stored for a particular feed. To put it another away, every single incoming log entry has to match those rules otherwise it will simply be ignored; it won’t go into the feed store, it won’t trigger any notifications, and it won’t appear in any reports.
   By default, every feed starts out unfiltered, so all available log entries are collected. However, if you want to create filter rule for the feed, open the Feed Properties sheet and switch to the Filter tab. If you need help with actual rule construction, press the F1 key to bring up the Help file.
   Finally, don’t forget that if you want to use the same filter on a number of feeds, you can use “Copy Properties To…” to apply the current filter to any number of destination feeds.
2. In a Notification
   Rules entered here determine what incoming log entries will cause the notification to fire. If no rules are present, every incoming log entry is able to trigger the notification; where rules are present, the new log entry has to match those rules before the notification can fire.
   To define or edit notification rules, just work through the notification wizard to reach the “Define Criteria” page.
3. In a scheduled report definition
   Even if the feed itself is unfiltered you can still limit which log entries actually appear in the report by adding rules to the filter section of a report definition. To do this, create a new report (or edit an existing one) and look down through the form for the Filter section. Enable the Filter checkbox then click “Edit..” to access the filter page.
4. In the right hand viewing pane
   You can also apply view-level filters; while these affect only what you see on screen, don’t forget that you can dump that filtered view as an adhoc report via “Generate Report…” in the Report menu and via “Export to File” / “Export to Browser” in the File menu.
   To apply a view level filter to a feed, first click on the feed in the left hand pane then use “Filter…” in the View menu to access the filter page.

A great secondary use for view-level filters (#4 above) is to help test rules while you’re building them; after all, they show the result of the filter rules immediately! Once the right hand pane shows only the log entries you want to see, you know you’ve got the rules right. You can then transfer the rules to one of the other filter locations in a variety of different ways:

• Select all the rules on the filter page (CTRL+A), copy them to the clipboard (CTRL+C), then paste them into the destination page (CTRL+V).
• Save the ruleset as a named preset, then select it in the destination filter page via the “Actions” dropdown menu
• Save the ruleset to a file, and load it in the destination filter page (again via the “Actions” dropdown menu)