{"record":{"id":"721516dab1cb6354","repo":"fluent/fluentd","slug":"do-not-specify-both-regexp-and-exclude-in-or","errorCode":null,"errorMessage":"Do not specify both <regexp> and <exclude> in <or>","messagePattern":"Do not specify both <regexp> and <exclude> in <or>","errorType":"validation","errorClass":"Fluent::ConfigError","httpStatus":null,"severity":"error","filePath":"lib/fluent/plugin/filter_grep.rb","lineNumber":144,"sourceCode":"      end\n\n      @and_conditions.each do |and_condition|\n        if !and_condition.regexps.empty? && !and_condition.excludes.empty?\n          raise Fluent::ConfigError, \"Do not specify both <regexp> and <exclude> in <and>\"\n        end\n        and_condition.regexps.each do |e|\n          raise Fluent::ConfigError, \"Duplicate key in <and>: #{e.key}\" if regexp_and_conditions.key?(e.key)\n          regexp_and_conditions[e.key] = Expression.new(record_accessor_create(e.key), e.pattern)\n        end\n        and_condition.excludes.each do |e|\n          raise Fluent::ConfigError, \"Duplicate key in <and>: #{e.key}\" if exclude_and_conditions.key?(e.key)\n          exclude_and_conditions[e.key] = Expression.new(record_accessor_create(e.key), e.pattern)\n        end\n      end\n\n      @or_conditions.each do |or_condition|\n        if !or_condition.regexps.empty? && !or_condition.excludes.empty?\n          raise Fluent::ConfigError, \"Do not specify both <regexp> and <exclude> in <or>\"\n        end\n        or_condition.regexps.each do |e|\n          raise Fluent::ConfigError, \"Duplicate key in <or>: #{e.key}\" if regexp_or_conditions.key?(e.key)\n          regexp_or_conditions[e.key] = Expression.new(record_accessor_create(e.key), e.pattern)\n        end\n        or_condition.excludes.each do |e|\n          raise Fluent::ConfigError, \"Duplicate key in <or>: #{e.key}\" if exclude_or_conditions.key?(e.key)\n          exclude_or_conditions[e.key] = Expression.new(record_accessor_create(e.key), e.pattern)\n        end\n      end\n\n      @_regexp_and_conditions = regexp_and_conditions.values unless regexp_and_conditions.empty?\n      @_exclude_and_conditions = exclude_and_conditions.values unless exclude_and_conditions.empty?\n      @_regexp_or_conditions = regexp_or_conditions.values unless regexp_or_conditions.empty?\n      @_exclude_or_conditions = exclude_or_conditions.values unless exclude_or_conditions.empty?\n    end\n\n    def filter(tag, time, record)","sourceCodeStart":126,"sourceCodeEnd":162,"githubUrl":"https://github.com/fluent/fluentd/blob/dd45c6e18dc7be33b5e5a0f0767bf46307ff5626/lib/fluent/plugin/filter_grep.rb#L126-L162","documentation":"The <or> combinator section, like <and>, only accepts one directive kind: configure raises Fluent::ConfigError when an <or> section contains both nested <regexp> and <exclude> sections, since mixed positive/negative conditions inside one OR group is not a supported shape.","triggerScenarios":"A single <or> block holding both <regexp> key a ... and <exclude> key b ... — both or_condition.regexps and or_condition.excludes are non-empty.","commonSituations":"Trying to express 'field a matches X OR field b does not match Y'; porting boolean expressions from SQL-like or whitelist/blacklist logic into grep.","solutions":["Rewrite the logic: 'A or not B' must be decomposed — keep <or> for regexp-only alternatives and handle exclusions with a separate top-level <exclude> (or use multiple filters chained together)","If you need negation inside alternation, invert the pattern itself (e.g. use a negative lookahead in a <regexp> pattern)","Split the mixed <or> into an <or> of <regexp>s plus separate handling","Validate with fluentd --dry-run"],"exampleFix":"# before\n<or>\n  <regexp>\n    key level\n    pattern /error/\n  </regexp>\n  <exclude>\n    key env\n    pattern /^test/\n  </exclude>\n</or>\n\n# after\n<or>\n  <regexp>\n    key level\n    pattern /error/\n  </regexp>\n  <regexp>\n    key env\n    pattern /^(?!test)/\n  </regexp>\n</or>","handlingStrategy":"validation","validationCode":"conf.sections(:or).each do |or_sec|\n  has_regexp  = !or_sec.sections(:regexp).empty?\n  has_exclude = !or_sec.sections(:exclude).empty?\n  abort '<or> cannot contain both <regexp> and <exclude>' if has_regexp && has_exclude\nend","typeGuard":null,"tryCatchPattern":"begin\n  filter.configure(conf)\nrescue Fluent::ConfigError => e\n  abort e.message if e.message.include?('Do not specify both <regexp> and <exclude> in <or>')\n  raise\nend","preventionTips":["Keep <or> blocks single-kind","Rewrite negated alternations with lookahead regexes inside <regexp>","Lint grep combinator sections in CI","Dry-run every config change"],"tags":["fluentd","grep-filter","configuration","boolean-logic","configerror"],"backgroundTag":"config-validation-failed","analyzedSha":"dd45c6e18dc7be33b5e5a0f0767bf46307ff5626","analyzedAt":"2026-08-21T16:22:07.332Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}