Event filter

When an event is published in Canopsis, the event filter function decides whether to keep or delete it, based on objective criteria.

These criteria are based on event attributes:

• Source
• Component / Resource
• Message
• Severity…

Event filtering can also be used to enrich events and entities through several actions:

• Drop: delete an event
• Break: stop evaluation of the following rules
• Change entity: manipulate the identifier of an entity before it is registered in Canopsis (excluding personalized information).
• Enrichment: enrich or modify an event and add customized information to entities

For more information on the event filter module and many other features of our open-source hypervision solution, visit the Canopsis documentation. Any unanswered questions? You can also contact our technical team via the contact form.

✅ 2022 updates: Rules application schedule, pattern ergonomics and filter backup

Event filter rules (drop, enrichment) can now be executed according to a calendar.

The new pattern ergonomics make it easier to enter patterns, by providing suggestions (auto-completion) to the user to reduce the risk of errors.

Drivers can also configure “custom” templates for themselves, to filter alarms for example.

With this new pattern ergonomics, Canopsis presents you with all possible combinations when entering data.

✅ Mises à jour 2025 : Notification et traçabilité du filtrage d’événements

It is now possible to receive notifications on event filters and easily view all the filtering rules applied to an alarm, thanks to the traceability of enrichments.