Pipe
Pipe is the routing stage of the pipeline. It filters, transforms and directs events from sources to one or more sinks based on declarative rules.
Filters
Each pipe evaluates events against an ordered list of filters. An event continues down the pipe only if every filter matches:
Level — match by severity (debug, info, warn, error, fatal)
Field — compare structured fields against exact values or ranges
Regex — full-text patterns applied to the raw message
Rate — throttle noisy sources with events-per-second limits
Transforms
Between filtering and delivery, pipes can reshape events on the fly:
Rename, add or drop fields before delivery
Mask sensitive values such as tokens and card numbers
Enrich events with static tags or lookup tables
Routing Example
Pipes connect sources to sinks. A single event can fan out to multiple sinks:
yaml
pipes:
- name: errors-to-alerts
from: [syslog, app-http]
filter:
level: error
to: [clickhouse, telegram-alerts]
- name: everything-archive
from: "*"
to: [s3-archive]
Rules are evaluated top to bottom and hot-reloaded on change. Use the web UI Pipe Inspector to trace a live event through every rule it hits.