Post Filters are configurable filters applied to incoming events after data normalized and before database writing.

Users may find that even after they have successfully imported data using import filters, some of the data may not be what they expected or prefer. Post Filters allow users to replace strings of data such as POP3, SSH or other strings with relative and valid port information. Some users may also wish to do string searches for specific text one filter after another trying to identify strings to set event names or category names.

How you use post filters are up to you, they are very powerful and each field can have as many as you like.

Post Filters differ from Import Filters as they are designed to allow specific replacement and modification functions to be performed on the field data which has been imported through regular expressions in the Import Filter section.

Syntax Help:

Replace 9 with 5 Example:
E~9~5

This example does a case sensitive string match against the imported field looking to exactly match 9 and replace it with 5.
--

Replace SMTP with 25 Example:
S~SMTP~25

The above example does a case sensitive string search against the imported field searching for SMTP within the field and replaces it with 25.
--

Set default port of 1024 Example:
D~NULL~1024

The above example if not previously matched by any other post filter will set the field value to 1024. Note NULL is used as this column is not needed.