<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE lire:global-filter-spec PUBLIC
  "-//LogReport.ORG//DTD Lire Report Specification Markup Language V1.0//EN"
  "http://www.logreport.org/LRSML/1.0/lrsml.dtd">
<lire:global-filter-spec xmlns:lire="http://www.logreport.org/LRSML/"
 id="exclude-priority" superservice="syslog">

 <lire:title>Exclude Priority Filter</lire:title>

 <lire:description>
  <para>This filter can be used to exclude
   <structname>syslog</structname> records based on the priority
   (<structfield>facility</structfield> and
   <structfield>level</structfield>) of the message.
  </para>
 </lire:description>

 <lire:param-spec>
  <lire:param name="facility_match" type="string" default=".*">
   <lire:description>
    <para>Regular expression used to select the facility that the
     event <emphasis>must not</emphasis> come from. The match is case insensitive.
    </para>
   </lire:description>
  </lire:param>

  <lire:param name="level_match" type="string" default=".*">
   <lire:description>
    <para>Regular expression used to select the level that the event
     <emphasis>must not </emphasis>come from. The match is case
     insensitive.
    </para>
   </lire:description>
  </lire:param>
 </lire:param-spec>

 <lire:display-spec>
  <lire:title>excluded messages with facility matching $facility_match and
   level matching $level_match</lire:title>
 </lire:display-spec>

 <lire:filter-spec>
  <lire:not>
   <lire:and>
    <lire:match value="$facility" re="$facility_match" case-sensitive="false"/>
    <lire:match value="$level" re="$level_match" case-sensitive="false"/>
   </lire:and>
  </lire:not>
 </lire:filter-spec>

</lire:global-filter-spec>
