{"record":{"id":"17c5690e5b3e833d","repo":"fluent/fluentd","slug":"do-not-specify-both-regexp-and-exclude-in-and","errorCode":null,"errorMessage":"Do not specify both <regexp> and <exclude> in <and>","messagePattern":"Do not specify both <regexp> and <exclude> in <and>","errorType":"validation","errorClass":"Fluent::ConfigError","httpStatus":null,"severity":"error","filePath":"lib/fluent/plugin/filter_grep.rb","lineNumber":130,"sourceCode":"      if @regexps.size > 1\n        log.info \"Top level multiple <regexp> is interpreted as 'and' condition\"\n      end\n      @regexps.each do |e|\n        raise Fluent::ConfigError, \"Duplicate key: #{e.key}\" if regexp_and_conditions.key?(e.key)\n        regexp_and_conditions[e.key] = Expression.new(record_accessor_create(e.key), e.pattern)\n      end\n\n      if @excludes.size > 1\n        log.info \"Top level multiple <exclude> is interpreted as 'or' condition\"\n      end\n      @excludes.each do |e|\n        raise Fluent::ConfigError, \"Duplicate key: #{e.key}\" if exclude_or_conditions.key?(e.key)\n        exclude_or_conditions[e.key] = Expression.new(record_accessor_create(e.key), e.pattern)\n      end\n\n      @and_conditions.each do |and_condition|\n        if !and_condition.regexps.empty? && !and_condition.excludes.empty?\n          raise Fluent::ConfigError, \"Do not specify both <regexp> and <exclude> in <and>\"\n        end\n        and_condition.regexps.each do |e|\n          raise Fluent::ConfigError, \"Duplicate key in <and>: #{e.key}\" if regexp_and_conditions.key?(e.key)\n          regexp_and_conditions[e.key] = Expression.new(record_accessor_create(e.key), e.pattern)\n        end\n        and_condition.excludes.each do |e|\n          raise Fluent::ConfigError, \"Duplicate key in <and>: #{e.key}\" if exclude_and_conditions.key?(e.key)\n          exclude_and_conditions[e.key] = Expression.new(record_accessor_create(e.key), e.pattern)\n        end\n      end\n\n      @or_conditions.each do |or_condition|\n        if !or_condition.regexps.empty? && !or_condition.excludes.empty?\n          raise Fluent::ConfigError, \"Do not specify both <regexp> and <exclude> in <or>\"\n        end\n        or_condition.regexps.each do |e|\n          raise Fluent::ConfigError, \"Duplicate key in <or>: #{e.key}\" if regexp_or_conditions.key?(e.key)\n          regexp_or_conditions[e.key] = Expression.new(record_accessor_create(e.key), e.pattern)","sourceCodeStart":112,"sourceCodeEnd":148,"githubUrl":"https://github.com/fluent/fluentd/blob/dd45c6e18dc7be33b5e5a0f0767bf46307ff5626/lib/fluent/plugin/filter_grep.rb#L112-L148","documentation":"The <and> combinator section in the grep filter accepts nested <regexp> and <exclude> directives, but only one kind per <and> block. configure raises Fluent::ConfigError when and_condition.regexps and and_condition.excludes are both non-empty, because 'match AND not-match' inside one block is ambiguous with the plugin's condition model.","triggerScenarios":"A single <and> section containing both a <regexp> and an <exclude>, e.g. <and> <regexp> key a pattern /x/ </regexp> <exclude> key b pattern /y/ </exclude> </and>.","commonSituations":"Users assuming <and> means 'all conditions in this block AND-ed' including negations; migrating complex boolean logic from other tools into grep's and/or sections.","solutions":["Split into two <and> sections: one holding the <regexp>, one holding the <exclude> (top-level <regexp>s are AND, top-level <exclude>s are also AND'ed against the record passing regexps)","Remember the intended semantics: records pass when all regexp AND-conditions match and all exclude conditions do NOT match — a single <and> with both is unnecessary","Use <or> sections with nested single-type directives for compound OR logic","Validate with fluentd --dry-run"],"exampleFix":"# before\n<and>\n  <regexp>\n    key level\n    pattern /error/\n  </regexp>\n  <exclude>\n    key hostname\n    pattern /^test-/\n  </exclude>\n</and>\n\n# after\n<regexp>\n  key level\n  pattern /error/\n</regexp>\n<exclude>\n  key hostname\n  pattern /^test-/\n</exclude>","handlingStrategy":"validation","validationCode":"conf.sections(:and).each do |and_sec|\n  has_regexp  = !and_sec.sections(:regexp).empty?\n  has_exclude = !and_sec.sections(:exclude).empty?\n  abort '<and> cannot contain both <regexp> and <exclude>' if has_regexp && has_exclude\nend","typeGuard":null,"tryCatchPattern":"begin\n  filter.configure(conf)\nrescue Fluent::ConfigError => e\n  abort e.message if e.message.include?('Do not specify both <regexp> and <exclude> in <and>')\n  raise\nend","preventionTips":["Keep each <and> block single-kind (only <regexp> or only <exclude>)","Express negation via top-level <exclude>, not inside <and>","Write a config lint rule for grep combinator sections","CI dry-run"],"tags":["fluentd","grep-filter","configuration","boolean-logic","configerror"],"backgroundTag":"config-validation-failed","analyzedSha":"dd45c6e18dc7be33b5e5a0f0767bf46307ff5626","analyzedAt":"2026-08-21T16:22:07.332Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}