fluent/fluentd · error · Fluent::ConfigError

Do not specify both <regexp> and <exclude> in <and>

Error message

Do not specify both <regexp> and <exclude> in <and>

What it means

The <and> combinator section in the grep filter accepts nested <regexp> and <exclude> directives, but only one kind per <and> block. configure raises Fluent::ConfigError when and_condition.regexps and and_condition.excludes are both non-empty, because 'match AND not-match' inside one block is ambiguous with the plugin's condition model.

Source

Thrown at lib/fluent/plugin/filter_grep.rb:130

      if @regexps.size > 1
        log.info "Top level multiple <regexp> is interpreted as 'and' condition"
      end
      @regexps.each do |e|
        raise Fluent::ConfigError, "Duplicate key: #{e.key}" if regexp_and_conditions.key?(e.key)
        regexp_and_conditions[e.key] = Expression.new(record_accessor_create(e.key), e.pattern)
      end

      if @excludes.size > 1
        log.info "Top level multiple <exclude> is interpreted as 'or' condition"
      end
      @excludes.each do |e|
        raise Fluent::ConfigError, "Duplicate key: #{e.key}" if exclude_or_conditions.key?(e.key)
        exclude_or_conditions[e.key] = Expression.new(record_accessor_create(e.key), e.pattern)
      end

      @and_conditions.each do |and_condition|
        if !and_condition.regexps.empty? && !and_condition.excludes.empty?
          raise Fluent::ConfigError, "Do not specify both <regexp> and <exclude> in <and>"
        end
        and_condition.regexps.each do |e|
          raise Fluent::ConfigError, "Duplicate key in <and>: #{e.key}" if regexp_and_conditions.key?(e.key)
          regexp_and_conditions[e.key] = Expression.new(record_accessor_create(e.key), e.pattern)
        end
        and_condition.excludes.each do |e|
          raise Fluent::ConfigError, "Duplicate key in <and>: #{e.key}" if exclude_and_conditions.key?(e.key)
          exclude_and_conditions[e.key] = Expression.new(record_accessor_create(e.key), e.pattern)
        end
      end

      @or_conditions.each do |or_condition|
        if !or_condition.regexps.empty? && !or_condition.excludes.empty?
          raise Fluent::ConfigError, "Do not specify both <regexp> and <exclude> in <or>"
        end
        or_condition.regexps.each do |e|
          raise Fluent::ConfigError, "Duplicate key in <or>: #{e.key}" if regexp_or_conditions.key?(e.key)
          regexp_or_conditions[e.key] = Expression.new(record_accessor_create(e.key), e.pattern)

View on GitHub (pinned to dd45c6e18d)

Solutions

1. Split into two <and> sections: one holding the <regexp>, one holding the <exclude> (top-level <regexp>s are AND, top-level <exclude>s are also AND'ed against the record passing regexps)
2. Remember the intended semantics: records pass when all regexp AND-conditions match and all exclude conditions do NOT match — a single <and> with both is unnecessary
3. Use <or> sections with nested single-type directives for compound OR logic
4. Validate with fluentd --dry-run

Example fix

# before
<and>
  <regexp>
    key level
    pattern /error/
  </regexp>
  <exclude>
    key hostname
    pattern /^test-/
  </exclude>
</and>

# after
<regexp>
  key level
  pattern /error/
</regexp>
<exclude>
  key hostname
  pattern /^test-/
</exclude>

conf.sections(:and).each do |and_sec|
  has_regexp  = !and_sec.sections(:regexp).empty?
  has_exclude = !and_sec.sections(:exclude).empty?
  abort '<and> cannot contain both <regexp> and <exclude>' if has_regexp && has_exclude
end

begin
  filter.configure(conf)
rescue Fluent::ConfigError => e
  abort e.message if e.message.include?('Do not specify both <regexp> and <exclude> in <and>')
  raise
end

When it happens

Trigger: A single <and> section containing both a <regexp> and an <exclude>, e.g. <and> <regexp> key a pattern /x/ </regexp> <exclude> key b pattern /y/ </exclude> </and>.

Common situations: Users assuming <and> means 'all conditions in this block AND-ed' including negations; migrating complex boolean logic from other tools into grep's and/or sections.

Understand the failure class

Background: Config validation failed: what "invalid value for {key}" and settings-rejection errors mean across 19 open-source libraries — this error's family across 19 libraries.

Related errors

• Do not specify both <regexp> and <exclude> in <or>
• regexp#{i} does not contain 2 parameters
• regexp#{i} contains a duplicated key, #{key}
• exclude#{i} does not contain 2 parameters
• exclude#{i} contains a duplicated key, #{key}

AI-assisted analysis of fluent/fluentd@dd45c6e18d (2026-08-21). Data as JSON: /api/errors/17c5690e5b3e833d. Report an issue: GitHub.