Log and Event Stream Filters

Exclusion filters drop individual log records and bucket events before MinIO AIStor records them. Use a filter to keep a high-volume operation, such as GetObject, out of an audit trail or a SIEM feed without turning the whole stream off.

A dropped record reaches no target and is not stored in the queue directory.

Filterable streams

Four streams accept a filter. Each has its own configuration setting, so you can filter the audit trail and the bucket event feed independently.

Stream	What it records	Configuration setting	Key	Metric label
API logs	S3 and internal API calls	`log_api_queue`	`exclude_apis`	`api`
Audit logs	Admin and console operations	`log_audit_queue`	`exclude_apis`	`audit`
Audit event queue	S3 and admin calls in the audit event format	`audit_event_queue`	`exclude_apis`	`audit_legacy`
Bucket events	S3 event notifications	`bucket_event_queue`	`exclude_events`	`event`

The error, system, and alert streams have no exclusion filter.

Exclude APIs

Environment Variable Configuration Setting

Specify a comma-separated list of API names to drop. Defaults to empty, which records every API call.

mc admin config set ALIAS log_api_queue exclude_apis="GetObject,HeadObject"

Use the bare route name, such as GetObject. The qualified name that mc admin trace displays, such as s3.GetObject, matches nothing.

Add a :STATUS suffix to drop only the records that carry that HTTP response status:

mc admin config set ALIAS log_api_queue exclude_apis="GetObject:206"

A record with no response status never matches a suffixed entry. Records of internal background work, such as healing, lifecycle, and batch jobs, carry no status.

The suffix is of little use on log_audit_queue. MinIO AIStor writes those records while the request is still being handled, before the response status exists, so a suffixed entry matches only the calls that write their response first. Filter that stream by name alone.

Exclude events

Environment Variable Configuration Setting

Specify a comma-separated list of S3 event names to drop. Defaults to empty, which delivers every event the bucket’s notification rules select.

mc admin config set ALIAS bucket_event_queue exclude_events="s3:ObjectAccessed:Get,s3:ObjectAccessed:Head"

Use the full event name, including the s3: prefix. See Bucket Notifications for the event names MinIO AIStor publishes.

How names are matched

Both keys behave the same way:

Matching is exact and ignores case.
There are no wildcards. Get* is read as a literal name and matches nothing.
Whitespace around an entry is trimmed, and empty entries are skipped.
The asterisk in s3:BucketCreated:* and s3:BucketRemoved:* is part of those two event names, so the literal spelling drops them.
The :STATUS suffix is recognized only when the text after the last colon is a number. Event names such as s3:ObjectAccessed:Get therefore stay intact.

MinIO AIStor does not validate the list. A name that matches nothing is accepted and silently filters nothing.

Confirm a filter is working

MinIO AIStor counts every dropped record in minio_logs_filter_dropped_total, published at /minio/metrics/v3/logs/filter. The stream label carries the value listed for each stream in Filterable streams. All four streams are reported, and an unfiltered stream reports zero.

A counter that stays at zero means one of three things: the stream is quiet, the pattern matches nothing, or the stream has no active target.

Scope of a filter

Setting exclude_apis on log_api_queue or log_audit_queue also keeps the dropped records out of the console log view, because both queues and the console log store are fed from the same point.

These settings are dynamic. Changes made with mc admin config set apply without a server restart.

There is no config.yaml route to these keys. Set them with mc admin config set or with the environment variable, which takes precedence over a stored value.