Paste logs. Change the pipeline. See what survives.

# Edit this pipeline. Expanso validates it as you type.
input:
  http_server: { address: "0.0.0.0:8081", path: /ingest }
pipeline:
  processors:
    - mapping: |
        let raw = content().string()
        let parsed = $raw.parse_json().catch({})
        let level = $parsed.level.string().lowercase().catch("unknown")
        let is_debug = $level == "debug"
        let should_drop = (
          $is_debug
        )
        root = if $should_drop {
          deleted()
        } else {
          {
            "log": $raw,
            "provenance": {
              "processed_by": "Expanso Sift",
              "pipeline": "sift-live-filter"
            }
          }
        }
output:
  sync_response: {}