fluent/fluentd · error · Fluent::ConfigError

Do not specify both <regexp> and <exclude> in <or>

Error message

Do not specify both <regexp> and <exclude> in <or>

What it means

The <or> combinator section, like <and>, only accepts one directive kind: configure raises Fluent::ConfigError when an <or> section contains both nested <regexp> and <exclude> sections, since mixed positive/negative conditions inside one OR group is not a supported shape.

Source

Thrown at lib/fluent/plugin/filter_grep.rb:144

      end

      @and_conditions.each do |and_condition|
        if !and_condition.regexps.empty? && !and_condition.excludes.empty?
          raise Fluent::ConfigError, "Do not specify both <regexp> and <exclude> in <and>"
        end
        and_condition.regexps.each do |e|
          raise Fluent::ConfigError, "Duplicate key in <and>: #{e.key}" if regexp_and_conditions.key?(e.key)
          regexp_and_conditions[e.key] = Expression.new(record_accessor_create(e.key), e.pattern)
        end
        and_condition.excludes.each do |e|
          raise Fluent::ConfigError, "Duplicate key in <and>: #{e.key}" if exclude_and_conditions.key?(e.key)
          exclude_and_conditions[e.key] = Expression.new(record_accessor_create(e.key), e.pattern)
        end
      end

      @or_conditions.each do |or_condition|
        if !or_condition.regexps.empty? && !or_condition.excludes.empty?
          raise Fluent::ConfigError, "Do not specify both <regexp> and <exclude> in <or>"
        end
        or_condition.regexps.each do |e|
          raise Fluent::ConfigError, "Duplicate key in <or>: #{e.key}" if regexp_or_conditions.key?(e.key)
          regexp_or_conditions[e.key] = Expression.new(record_accessor_create(e.key), e.pattern)
        end
        or_condition.excludes.each do |e|
          raise Fluent::ConfigError, "Duplicate key in <or>: #{e.key}" if exclude_or_conditions.key?(e.key)
          exclude_or_conditions[e.key] = Expression.new(record_accessor_create(e.key), e.pattern)
        end
      end

      @_regexp_and_conditions = regexp_and_conditions.values unless regexp_and_conditions.empty?
      @_exclude_and_conditions = exclude_and_conditions.values unless exclude_and_conditions.empty?
      @_regexp_or_conditions = regexp_or_conditions.values unless regexp_or_conditions.empty?
      @_exclude_or_conditions = exclude_or_conditions.values unless exclude_or_conditions.empty?
    end

    def filter(tag, time, record)

View on GitHub (pinned to dd45c6e18d)

Solutions

1. Rewrite the logic: 'A or not B' must be decomposed — keep <or> for regexp-only alternatives and handle exclusions with a separate top-level <exclude> (or use multiple filters chained together)
2. If you need negation inside alternation, invert the pattern itself (e.g. use a negative lookahead in a <regexp> pattern)
3. Split the mixed <or> into an <or> of <regexp>s plus separate handling
4. Validate with fluentd --dry-run

Example fix

# before
<or>
  <regexp>
    key level
    pattern /error/
  </regexp>
  <exclude>
    key env
    pattern /^test/
  </exclude>
</or>

# after
<or>
  <regexp>
    key level
    pattern /error/
  </regexp>
  <regexp>
    key env
    pattern /^(?!test)/
  </regexp>
</or>

conf.sections(:or).each do |or_sec|
  has_regexp  = !or_sec.sections(:regexp).empty?
  has_exclude = !or_sec.sections(:exclude).empty?
  abort '<or> cannot contain both <regexp> and <exclude>' if has_regexp && has_exclude
end

begin
  filter.configure(conf)
rescue Fluent::ConfigError => e
  abort e.message if e.message.include?('Do not specify both <regexp> and <exclude> in <or>')
  raise
end

When it happens

Trigger: A single <or> block holding both <regexp> key a ... and <exclude> key b ... — both or_condition.regexps and or_condition.excludes are non-empty.

Common situations: Trying to express 'field a matches X OR field b does not match Y'; porting boolean expressions from SQL-like or whitelist/blacklist logic into grep.

Understand the failure class

Background: Config validation failed: what "invalid value for {key}" and settings-rejection errors mean across 19 open-source libraries — this error's family across 19 libraries.

Related errors

• Do not specify both <regexp> and <exclude> in <and>
• regexp#{i} does not contain 2 parameters
• regexp#{i} contains a duplicated key, #{key}
• exclude#{i} does not contain 2 parameters
• exclude#{i} contains a duplicated key, #{key}

AI-assisted analysis of fluent/fluentd@dd45c6e18d (2026-08-21). Data as JSON: /api/errors/721516dab1cb6354. Report an issue: GitHub.