log4net filter - how to write AND filter to ignore log messages

Question

I am struggling to write an AND conditional filter in log4net. Had it been nLog, I could have written it this way:

<logger name="*" minlevel="Info" xsi:type="NLogLoggerRule" writeTo="FooLogger" >
  <filters>
    <when condition="equals('${event-context:item=UserID}', 'TESTUSER') 
                 and equals('${event-context:item=URL}','/foo/foobar.aspx')" 
          action="Ignore" />
  </filters>
</logger>

I am not sure how to write the same filter in log4net. I have been so far successful, in writing a single condition:

<appender>
   ....
   <filter type="log4net.Filter.PropertyFilter">
      <key value="URL" />
      <stringToMatch value="/foo/foobar.aspx" />
      <acceptOnMatch value="false" />
   </filter>
</appender>

How can I write AND conditions using log4net filters? Please help.

Answer 1

A custom filter supporting AND conditions. This class exposes Filter property so existing log4net filters can be used here and also one can have nested AND conditions if required.

public class AndFilter : FilterSkeleton
{
    private bool acceptOnMatch;
    private readonly IList<IFilter> filters = new List<IFilter>();

    public override FilterDecision Decide(LoggingEvent loggingEvent)
    {
        if (loggingEvent == null)
            throw new ArgumentNullException("loggingEvent");

        foreach(IFilter filter in filters)
        {
            if (filter.Decide(loggingEvent) != FilterDecision.Accept)
                return FilterDecision.Neutral; // one of the filter has failed
        }

        // All conditions are true
        if(acceptOnMatch)
            return FilterDecision.Accept;
        else
            return FilterDecision.Deny;
    }

    public IFilter Filter 
    { 
        set { filters.Add(value); }
    }

    public bool AcceptOnMatch
    {
        get { return acceptOnMatch;}
        set { acceptOnMatch = value;}
    }
}

Config:

<filter type="Namespace.AndFilter, Assembly">
  <filter type="log4net.Filter.PropertyFilter">
    <key value="URL" />
    <stringToMatch value="/foo/foobar.aspx" />
  </filter>
  <filter type="log4net.Filter.PropertyFilter">
    <key value="UserID" />
    <stringToMatch value="TESTUSER" />
  </filter>
  <acceptOnMatch value="false" />
</filter>

Answer 2

You can create custom filter for your business needs:

public class UserRequestFilter : FilterSkeleton
{
    public override FilterDecision Decide(LoggingEvent loggingEvent)
    {
        if (loggingEvent == null)
            throw new ArgumentNullException("loggingEvent");

        string userId = (string)loggingEvent.Properties["UserId"];
        string url = (string)loggingEvent.Properties["Url"];

        if (String.IsNullOrEmpty(UserId) || String.IsNullOrEmpty(Url))
            return FilterDecision.Neutral;

        if (UserId.Equals(userId) && Url.Equals(url, StringComparison.CurrentCultureIgnoreCase))
            return AcceptOnMatch ? FilterDecision.Accept : FilterDecision.Deny;

        return FilterDecision.Neutral;
    }

    public bool AcceptOnMatch { get; set; }
    public string UserId { get; set; }
    public string Url { get; set; }
}

Configuration will look like this:

<filter type="Namespace.UserRequestFilter, Assembly">
  <userId value="TESTUSER"/>
  <url value="/foo/foobar.aspx"/>
  <acceptOnMatch value="true"/>
</filter>

Also you can create compound filter, but I didn't find way to use it in configuration. Looks like it could be attached only programmatically (which is useless ^_^):

IAppenderAttachable logger = (IAppenderAttachable)_log.Logger;
AppenderSkeleton appender = (AppenderSkeleton)logger.GetAppender("appenderName");
CompoundFilter compoundFilter = new CompoundFilter();
compoundFilter.AddFilter(new PropertyFilter() { Key = "UserId", StringToMatch = "TEST" });
compoundFilter.AddFilter(new PropertyFilter() { Key = "Url", StringToMatch = @"/foo/foobar.aspx" });
appender.AddFilter(compoundFilter);
logger.AddAppender(appender);

[UPDATE]

Here is trick that you can use - create filter, which will check all filters down the filters chain:

public class DenyAllSubsequentFilter : FilterSkeleton
{
    public override FilterDecision Decide(LoggingEvent loggingEvent)
    {
        IFilter nextFilter = Next;
        if (nextFilter == null)
            return FilterDecision.Accept;

        while (nextFilter != null)
        {
            if (nextFilter.Decide(loggingEvent) != FilterDecision.Deny)
                return FilterDecision.Accept;

            nextFilter = nextFilter.Next;
        }

        return FilterDecision.Deny;
    }
}

Usage:

<filter type="Namespace.DenyAllSubsequentFilter, Assembly"/>
<filter type="log4net.Filter.PropertyFilter">
  <key value="UserId" />
  <stringToMatch value="TEST" />
  <acceptOnMatch value="false" />
</filter>
<filter type="log4net.Filter.PropertyFilter">
  <key value="Url" />
  <stringToMatch value="/foo/foobar.aspx" />
  <acceptOnMatch value="false" />
</filter>

This filter will deny logging message if all subsequent filters will deny it.