Rules

Create filter + transform + routing rules from the dashboard. Dry-run before you enable.

The Rules page lives at Projects → your project → Rules. From here you create, edit, enable/disable, reorder, and dry-run the declarative rules that fire against every event.

For the rule DSL (match operators, action types, path syntax), see Rules in Concepts.

Creating a rule

Three ways:

  1. From scratch — click new rule, fill in name + stage + match + action. The editor has a builder tab (flat list of conditions with AND/OR) and a JSON tab (full tree for nested groups).

  2. From a template — click templates. Curated starters for:

    • Drop GitHub bot PRs
    • Drop Stripe test events
    • Redact API keys in webhook bodies
    • Tag urgent Slack mentions

    Clicking use pre-fills the create modal; tweak and save.

  3. From a file — click import. Upload a JSON file exported from another project (or hand-written). Single object or array; each entry validates independently, malformed ones are skipped with a summary toast.

Editor

The editor has three blocks:

  • Basics — name, description, priority (lower = higher priority), stage (ingest / deliver; only deliver is live today), enabled flag.
  • Match — toggle between builder (flat AND/OR list of conditions; paths are free-form dotted JSON) and JSON (full tree). Paths are validated inline — empty, leading/trailing dot, double dots, whitespace all flag red.
  • Action — pill selector for drop / transform / route only / tag, with a per-type parameter panel underneath:
    • Transform: list of ops (set / redact / uppercase / lowercase / trim) with path + value / regex fields.
    • Route only: checkboxes against the project’s endpoints.
    • Tag: chip input; enter or comma commits.

Validate

The validate button in the footer rounds-trips to the server’s rule compiler without saving. You’ll see:

  • ✓ valid — everything parses and all referenced ops / regexes / endpoint IDs are legal.
  • An inline error — unknown op, malformed regex, bad stage-action combination, invalid endpoint UUID, etc.

Dry-run

The dry-run Nh button replays the draft rule against the last 1h, 24h, or 7d of historical events (pick the window via the pill row). Read-only — the rule is not enabled, no rows are written.

Results show:

  • Headline: matched / scanned (X%), duration, truncated flag.
  • Per-action chips (drop: 12, transform: 3, …).
  • Up to 50 matched records as cards, each showing:
    • Event ID + source + timestamp + action badge
    • The event’s data block as the rule saw it
    • For transforms: the after diff side-by-side
    • For route_only: the endpoint IDs the rule would route to
    • For tag: the tags it would add
    • For drop: a note that the event would be persisted with status=dropped and skip fanout

Use this to confirm the rule matches what you expect before it starts affecting live events.

List behavior

  • Rules are evaluated priority-first. Lower priorities run earlier.
  • The first matching drop rule short-circuits the walk — later rules don’t evaluate for that event.
  • Transform / route / tag rules that match compose across rules — multiple transforms stack in priority order.
  • Each rule shows its match count and last matched timestamp inline, so you can tell at a glance whether a rule is pulling its weight.

Export

Export downloads all project rules as JSON, suitable for copying to another project, backing up, or diffing in version control. Server-side fields (id, match_count, timestamps) are stripped; only the portable definition ships out.

← Previous Connections Next → Team