Introduction
Exclude and Include Filters, set up in the admin interface and applied to a log source or profile, are used to eliminate unwanted hits when processing a log file. The filters use POSIX regular expressions when matching against data in the fields of a hit. If you are unfamiliar with regular expressions, please read the Regular Expression Overview document in this section before proceeding.
How Urchin Uses Exclude/Include Filters
These filters are applied after the Decode URL, Japanese Encode, Dynamic URL, Search & Replace and Advanced filters. Urchin applies the Exclude/Include filters in succession. If the filter being applied is an Exclude Filter and the pattern matches, the hit is thrown away and Urchin continues with the next hit. If the pattern does not match, Urchin applies the next filter to the hit. This means that you can create either a single Exclude Filter with multiple patterns separated by '|' or you can create multiple Exclude Filters with a single pattern each.
Include Filters are applied with the reverse logic. When an Include Filter is applied, the hit is thrown away if the pattern does not match the data. If multiple Include Filters are applied, the hit must match every applied Include Filter in order for the hit to be saved. To include multiple patterns for a specific field, create a single include filter that contains all of the individual expressions separated by '|'.
Using Exclude/Include Filters
In the figure above, the exclude filter requires a filter expression and a filter field. During processing, the filter expression is compared with data in the filter field and the hit is thrown away if the filter matches. See the Filter Fields article for a complete list of fields that are available. The above example illustrates how to filter out image hits by filtering out all mime types that match gif, jpg, png, jpeg, and ico. This list can be customized to match any mime type.
In the figure above, the include filter requires a filter expression and a filter field. During processing, the filter expression is compared with data in the filter field and the hit is thrown away if the filter does not match. See the Filter Fields article for a complete list of fields that are available. This example shows how to filter in only html pages by requiring the mime type of the request to be html.
Controls
The 'Case Sensitive' control allows you to specify whether the filter should be applied with or without case sensitivity.