[processor/filter] Add filter action identifier

.chloggen/filterprocessor_action_option.yaml

@@ -0,0 +1,27 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: "enhancement"
+
+# The name of the component, or a single word describing the area of concern, (e.g. receiver/filelog)
+component: processor/filter
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Added an "action" option to Logs, Metrics, Traces and Profiles to specify the behavior when conditions match.
+
+# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists.
+issues: [42321]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:
+
+# If your change doesn't affect end users or the exported elements of any package,
+# you should instead start your pull request title with [chore] or use the "Skip Changelog" label.
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: [user]

processor/filterprocessor/README.md

@@ -56,13 +56,23 @@ The filter processor also allows configuring an optional field, `error_mode`, wh
 
 If not specified, `propagate` will be used.
 
+The filter processor allows configuring an optional field, `action`, which determines the behavior when conditions match.
+
+| action | description                                                                                              |
+|--------|----------------------------------------------------------------------------------------------------------|
+| drop   | Drop signals that match the conditions and retain all others. This is the default behavior.              |
+| keep   | Retain signals that match the conditions and drop all others. This effectively inverts the `drop` logic. |
+
+If not specified, `drop` will be used.
+
 ### Examples
 
 ```yaml
 processors:
   filter/ottl:
     error_mode: ignore
     traces:
+      action: drop
       span:
         - 'attributes["container.name"] == "app_container_1"'
         - 'resource.attributes["host.name"] == "localhost"'
@@ -71,17 +81,20 @@ processors:
         - 'attributes["grpc"] == true'
         - 'IsMatch(name, ".*grpc.*")'
     metrics:
+      action: drop
       metric:
           - 'name == "my.metric" and resource.attributes["my_label"] == "abc123"'
           - 'type == METRIC_DATA_TYPE_HISTOGRAM'
       datapoint:
           - 'metric.type == METRIC_DATA_TYPE_SUMMARY'
           - 'resource.attributes["service.name"] == "my_service_name"'
     logs:
+      action: drop
       log_record:
         - 'IsMatch(body, ".*password.*")'
         - 'severity_number < SEVERITY_NUMBER_WARN'
     profiles:
+      action: drop
       profile:
         - 'duration_unix_nano > 3000'
 ```
@@ -92,6 +105,18 @@ processors:
   filter:
     error_mode: ignore
     traces:
+      action: drop
+      span:
+        - IsMatch(resource.attributes["k8s.pod.name"], "my-pod-name.*")
+```
+
+#### Keeping data based on a resource attribute
+```yaml
+processors:
+  filter:
+    error_mode: ignore
+    traces:
+      action: keep
       span:
         - IsMatch(resource.attributes["k8s.pod.name"], "my-pod-name.*")
 ```

processor/filterprocessor/common.go

@@ -0,0 +1,16 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+package filterprocessor // import "github.com/open-telemetry/opentelemetry-collector-contrib/processor/filterprocessor"
+
+import "github.com/open-telemetry/opentelemetry-collector-contrib/internal/filter/expr"
+
+// applyActionToExpr applies the configured action to expr.BoolExpr.
+// - keepAction: inverts the expression
+// - dropAction: returns expression unchanged
+func applyActionToExpr[K any](boolExpr expr.BoolExpr[K], action Action) expr.BoolExpr[K] {
+	if action == keepAction {
+		return expr.Not(boolExpr)
+	}
+	return boolExpr
+}

processor/filterprocessor/config.go

@@ -65,6 +65,9 @@ type MetricFilters struct {
 	// If both Include and Exclude are specified, Include filtering occurs first.
 	Exclude *filterconfig.MetricMatchProperties `mapstructure:"exclude"`
 
+	// Action specifies the behavior when conditions match. The default is drop.
+	Action Action `mapstructure:"action"`
+
 	// RegexpConfig specifies options for the regexp match type
 	RegexpConfig *regexp.Config `mapstructure:"regexp"`
 
@@ -81,6 +84,9 @@ type MetricFilters struct {
 
 // TraceFilters filters by OTTL conditions
 type TraceFilters struct {
+	// Action specifies the behavior when conditions match. The default is drop.
+	Action Action `mapstructure:"action"`
+
 	// SpanConditions is a list of OTTL conditions for an ottlspan context.
 	// If any condition resolves to true, the span will be dropped.
 	// Supports `and`, `or`, and `()`
@@ -103,6 +109,9 @@ type LogFilters struct {
 	// If both Include and Exclude are specified, Include filtering occurs first.
 	Exclude *LogMatchProperties `mapstructure:"exclude"`
 
+	// Action specifies the behavior when conditions match. The default is drop.
+	Action Action `mapstructure:"action"`
+
 	// LogConditions is a list of OTTL conditions for an ottllog context.
 	// If any condition resolves to true, the log event will be dropped.
 	// Supports `and`, `or`, and `()`
@@ -281,12 +290,36 @@ func (lmp LogSeverityNumberMatchProperties) validate() error {
 type ProfileFilters struct {
 	_ struct{} // prevent unkeyed literals
 
+	// Action specifies the behavior when conditions match. The default is drop.
+	Action Action `mapstructure:"action"`
+
 	// ProfileConditions is a list of OTTL conditions for an ottlprofile context.
 	// If any condition resolves to true, the profile will be dropped.
 	// Supports `and`, `or`, and `()`
 	ProfileConditions []string `mapstructure:"profile"`
 }
 
+// Action specifies the behavior when conditions match. The default is drop.
+type Action string
+
+const (
+	// dropAction drops signals that match the conditions and retains all others.
+	dropAction = Action("drop")
+	// keepAction retains signals that match the conditions and drops all others.
+	keepAction = Action("keep")
+)
+
+func (a *Action) UnmarshalText(text []byte) error {
+	str := Action(strings.ToLower(string(text)))
+	switch str {
+	case dropAction, keepAction:
+		*a = str
+		return nil
+	default:
+		return fmt.Errorf("unknown action \"%s\": must be \"%s\" or \"%s\"", str, dropAction, keepAction)
+	}
+}
+
 var _ component.Config = (*Config)(nil)
 
 // Validate checks if the processor configuration is valid