Audit and fix all filter plugin docs for consistency, accuracy, and completeness.

[eschabell]

Changes applied across all 20 filter docs:

• Parameter tables use lowercase keys matching source code names
• Parameter tables sorted alphabetically
• Missing parameters added (verified against source FLB_CONFIG_MAP)
• Classic config examples use Name/Match in Title_Case; plugin-specific keys in lowercase
• YAML examples use all-lowercase keys
• Prose and formatting fixes (hard line wraps, typos, Vale linting)

Files changed

• aws-metadata.md — add missing enable_entity param; sort table; fix indentation
• checklist.md — sort table; fix lookup_key default; remove non-plugin params from examples
• ecs-metadata.md — add missing agent_endpoint_retries, ecs_meta_host, ecs_meta_port; sort table; lowercase keys
• expect.md — fix table header; sort table; add Default column with source-verified values
• geoip2-filter.md — note that lookup_key supports multiple entries
• grep.md — lowercase table keys; sort table; add Default column
• kubernetes.md — fix prose and YAML typos; fix code fence type
• log_to_metrics.md — sort table; remove non-plugin params; fix duplicate histogram bucket
• lua.md — sort table; lowercase keys; fix section header casing; fix Vale contraction
• multiline-stacktrace.md — fix table header; sort table; add missing debug_flush param; fix typos
• nest.md — fix leading space in classic config; lowercase YAML filter keys
• nightfall.md — sort tls.* params; add missing tls.vhost param
• parser.md — fix trailing character typo in sample output; fix trailing whitespace
• record-modifier.md — sort table; lowercase table keys
• rewrite-tag.md — fix NAME → Name in classic config example
• sysinfo.md — sort table; lowercase keys; fix [OUTPUT] key casing
• tensorflow.md — fix description typo; fix default casing; fix broken command-line example
• throttle.md — sort table; lowercase keys; fix Vale flag
• type-converter.md — sort table; fix table formatting
• wasm.md — sort table; lowercase keys; fix WASM_Path; add accessible_paths default

Fixes #2409

Summary by CodeRabbit

• New Features

  • Added new AWS metadata configuration options: account_id, ami_id, vpc_id, private_ip, enable_entity toggle, and retry_interval_s; added new multiline-stacktrace keys (debug_flush, emitter_mem_buf_limit).

• Documentation

  • Standardized parameter names to snake_case, updated examples and defaults, added/adjusted defaults in several filters, corrected typos and formatting, and refreshed sample configurations and templates.

[coderabbitai]

Warning

Rate limit exceeded

@eschabell has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 14 minutes and 14 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 98008049-10c9-44bb-b4e9-10eb1556af81

📥 Commits

Reviewing files that changed from the base of the PR and between 07ed7d4 and ee5534a.

📒 Files selected for processing (1)

• pipeline/filters/aws-metadata.md

📝 Walkthrough

Walkthrough

Documentation updates across many pipeline filter docs: normalized configuration keys to snake_case, added/reordered Default columns and parameters, fixed typos/formatting, and expanded the AWS metadata filter's public configuration with new keys and examples. No runtime code changes.

Changes

Cohort / File(s)	Summary
AWS metadata expansion pipeline/filters/aws-metadata.md	Added public config keys account_id, ami_id, enable_entity, private_ip, retry_interval_s, vpc_id; reorganized parameters and updated YAML and fluent-bit.conf examples.
Snake_case normalization pipeline/filters/ecs-metadata.md, pipeline/filters/grep.md, pipeline/filters/nest.md, pipeline/filters/record-modifier.md, pipeline/filters/sysinfo.md, pipeline/filters/throttle.md, pipeline/filters/wasm.md	Renamed many config keys from CamelCase/PascalCase to snake_case (e.g., Regex → regex, Wasm_Path → wasm_path); updated examples and templates.
Parameter table defaults & ordering pipeline/filters/expect.md, pipeline/filters/grep.md, pipeline/filters/lua.md, pipeline/filters/multiline-stacktrace.md, pipeline/filters/type-converter.md	Added/updated Default column values, reordered parameter tables, introduced new table entries (e.g., debug_flush, emitter_mem_buf_limit, Lua keys) and adjusted examples.
Examples, typos, and minor fixes pipeline/filters/kubernetes.md, pipeline/filters/parser.md, pipeline/filters/rewrite-tag.md, pipeline/filters/tensorflow.md	Fixed typos and boolean literals, corrected small formatting in code blocks, and adjusted example snippets and CLI examples.
Docs restructuring & defaults adjustments pipeline/filters/checklist.md, pipeline/filters/geoip2-filter.md, pipeline/filters/log_to_metrics.md, pipeline/filters/nightfall.md	Changed defaults (e.g., lookup_key), clarified multi-key support for lookup_key, removed deprecated example lines (log_level), and reordered TLS/options entries in tables.

Sequence Diagram(s)

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Suggested reviewers

• cosmo0920
• esmerel

Poem

🐇 I hopped through docs with nimble feet,
snake_case trails and tables neat,
AWS grown with keys anew,
examples polished, typos few,
I twitch my nose — the docs look sweet!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: auditing and fixing all filter plugin docs for consistency, accuracy, and completeness across the entire Filters section.
Linked Issues check	✅ Passed	The PR comprehensively addresses issue #2409 objectives by auditing and fixing all 20 filter docs including parameter normalization, adding missing parameters, fixing defaults, standardizing tables, and correcting typos.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to the Filters section documentation audit as specified in #2409, with no unrelated modifications detected.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 11

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (4)

pipeline/filters/grep.md (2)

142-144: 🛠️ Refactor suggestion | 🟠 Major

Plugin-specific keys should be lowercase in classic config examples.

Per the PR objectives, plugin-specific parameters should use lowercase keys in classic configuration format to match the parameter table (lines 13-17). The examples currently use Title_Case for Exclude, Regex, and Logical_Op, but they should be lowercase: exclude, regex, and logical_op.

♻️ Proposed fixes for all affected examples

Example at lines 142-144:

 [FILTER]
   Name    grep
   Match   *
-  Exclude $kubernetes['labels']['app'] myapp
+  exclude $kubernetes['labels']['app'] myapp

Example at lines 183-186:

 [FILTER]
   Name                     grep
   Alias                    filter-iots-grep
   Match                    iots_thread.*
-  Regex                    iot_timestamp ^\d{4}-\d{2}-\d{2}
+  regex                    iot_timestamp ^\d{4}-\d{2}-\d{2}

Example at lines 240-244:

 [FILTER]
   Name grep
   Match *
-  Logical_Op or
-  Regex value something
-  Regex value error
+  logical_op or
+  regex value something
+  regex value error

Also applies to: 183-186, 240-244

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pipeline/filters/grep.md` around lines 142 - 144, The classic config examples
for the grep plugin use Title_Case keys; update the plugin-specific keys in the
grep examples to lowercase (e.g., change Exclude -> exclude, Regex -> regex,
Logical_Op -> logical_op) so they match the parameter table and PR conventions;
edit the grep examples shown (the blocks containing "Name grep" and the other
two examples referenced) and replace those capitalized keys with the lowercase
equivalents while leaving values and surrounding structure intact.

---

86-88: ⚠️ Potential issue | 🟡 Minor

Fix casing inconsistency in classic config example.

According to the PR objectives, classic config examples should use Title_Case for framework parameters (Name, Match) while plugin-specific keys remain lowercase. This example uses all lowercase, which is inconsistent with other examples in this file (lines 142-144, 183-186, 240-244).

📝 Proposed fix for consistent casing

 [FILTER]
-  name   grep
-  match  *
+  Name   grep
+  Match  *
   regex  log aa

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pipeline/filters/grep.md` around lines 86 - 88, The example config uses
lowercase framework keys but should follow Title_Case for framework parameters:
change "name" to "Name" and "match" to "Match" while keeping the plugin-specific
key "regex" lowercase; update the example block that currently reads "name  
grep / match  * / regex  log aa" to use "Name" and "Match" to match other
examples (retain "regex" as-is) so casing is consistent with the rest of the
document.

pipeline/filters/parser.md (1)

9-14: ⚠️ Potential issue | 🟠 Major

Update parameter tables and classic config examples to use lowercase keys for consistency with YAML examples and other updated filter documentation.

This file has internal inconsistency: YAML examples already use lowercase keys (key_name, parser, reserve_data, preserve_key), but the parameter table (lines 9-14) and classic config examples (lines 86-89, 186-190, 281-286) use Title_Case. Most other filter documentation (19 of 27 filter docs) have already been updated to use lowercase keys in parameter tables and config examples.

Update the following to lowercase:

• Parameter table: Key_Name → key_name, Parser → parser, Preserve_Key → preserve_key, Reserve_Data → reserve_data
• Classic config examples: Same key names in all three locations (lines 86-89, 186-190, 281-286)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pipeline/filters/parser.md` around lines 9 - 14, The parameter table and
classic config examples use Title_Case keys but must be lowercase to match YAML
examples and other docs; replace `Key_Name`→`key_name`, `Parser`→`parser`,
`Preserve_Key`→`preserve_key`, and `Reserve_Data`→`reserve_data` in the
parameter table and in all three classic config example blocks so the keys are
consistently lowercase (`key_name`, `parser`, `preserve_key`, `reserve_data`)
across parser.md (update the parameter table entries and the three classic
config examples).

pipeline/filters/kubernetes.md (1)

468-489: ⚠️ Potential issue | 🟡 Minor

Keep the classic example on the same snake_case schema.

This block still uses Use_Kubelet/Kubelet_Port and other Title_Case plugin keys, while the table and YAML example document use_kubelet/kubelet_port. The page is still mixed-format after this update.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pipeline/filters/kubernetes.md` around lines 468 - 489, The kubernetes filter
example uses Title_Case plugin keys (e.g., Kube_URL, Kube_CA_File,
Kube_Token_File, Use_Kubelet, Kubelet_Port, Merge_Log, Buffer_Size) while the
rest of the docs use snake_case; update those keys in the kubernetes [FILTER]
block to the snake_case equivalents (kube_url, kube_ca_file, kube_token_file,
use_kubelet, kubelet_port, merge_log, buffer_size) so the example matches the
documented schema for the kubernetes filter and stays consistent with the
table/YAML examples.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@pipeline/filters/aws-metadata.md`:
- Line 20: Update the table row for the configuration key retry_interval_s so
its description explicitly states the unit in seconds (e.g., "Defines minimum
duration between retries for fetching EC2 instance tags (seconds).") — edit the
description text for retry_interval_s to include "(seconds)" or similar explicit
wording so readers cannot mistake the unit.

In `@pipeline/filters/ecs-metadata.md`:
- Line 16: Update the documentation text for the option `ecs_meta_cache_ttl` so
the first occurrence of "TTL" is expanded to "time-to-live (TTL)"; specifically,
replace "max TTL" with "maximum time-to-live (TTL)" (or similar phrasing) in the
sentence describing the in-memory hash table to satisfy Vale and clarify the
term.

In `@pipeline/filters/geoip2-filter.md`:
- Line 18: The classic example still uses `Lookup_key` and `Record` while the
table and new convention use lowercase `lookup_key`; update the classic example
to normalize casing by replacing `Lookup_key` with `lookup_key` and `Record`
with `record` (and any other occurrences) so the example matches the documented
lowercase key style and supports multiple `lookup_key` entries as described.

In `@pipeline/filters/grep.md`:
- Around line 197-199: Fix two grammatical errors in the grep.md documentation:
change the phrase "If `exclude` match" to "If `exclude` matches" (subject-verb
agreement) and change "multiple `exclude` entry" to "multiple `exclude` entries"
(correct plural). Locate the sentences containing the exact fragments "If
`exclude` match" and "multiple `exclude` entry" and replace them with the
corrected forms.

In `@pipeline/filters/lua.md`:
- Around line 329-332: The examples use capitalized plugin keys
("Script"/"Call") which violates the file's lowercase convention and will
confuse users; update the Lua filter snippets to use the lowercase keys "script"
and "call" instead (e.g., the block that defines function append_tag(tag,
timestamp, record) should be under script and call, not Script/Call), and make
the same lowercase corrections for the other classic-example blocks mentioned
(the other Lua filter snippets that mirror this pattern).

In `@pipeline/filters/multiline-stacktrace.md`:
- Around line 41-51: The classic-mode config examples below the parameter table
use lowercase `name`/`match` but the PR standard is to use `Name` and `Match`
with plugin-specific keys in lowercase (e.g. `emitter_name`, `flush_ms`, `mode`,
`multiline.parser`); update each classic snippet to capitalize the top-level
plugin keys `Name` and `Match` while keeping all plugin-specific keys (like
`emitter_name`, `emitter_storage.type`, `multiline.key_content`,
`multiline.parser`, `buffer`, `debug_flush`, `emitter_mem_buf_limit`,
`flush_ms`, `mode`) in lowercase to match the standardized casing. Ensure every
example under the table reflects this change so casing is consistent across the
page.

In `@pipeline/filters/nest.md`:
- Around line 168-179: Update the parameter table to match the renamed keys used
in the examples: replace legacy capitalized names (Operation, Wildcard,
Nest_under, etc.) with the new lowercase keys (operation, wildcard, nest_under,
nested_under) and include the other used keys add_prefix and remove_prefix;
ensure each table row/description references the exact symbol names shown in the
example (operation, wildcard, nest_under, nested_under, add_prefix,
remove_prefix) so the schema in the table matches the examples.

In `@pipeline/filters/record-modifier.md`:
- Around line 11-15: Update the example configurations and CLI samples to use
the normalized lowercase parameter names (`record`, `remove_key`,
`allowlist_key`) instead of the old-cased `Record`, `Remove_key`, and
`Allowlist_key`; search for those uppercased tokens in the file (they appear in
the fluent-bit.conf and CLI examples) and replace them with the corresponding
lowercase symbols so the examples match the table and the rest of the page.

In `@pipeline/filters/sysinfo.md`:
- Around line 14-15: Update the example value for the os_name_key to use the
correct Apple branding: replace the lowercase "macos" example with "macOS" in
the pipeline/filters/sysinfo.md entry for os_name_key so the user-facing example
reads "Linux, win64 or macOS".

In `@pipeline/filters/throttle.md`:
- Around line 11-14: The docs show lowercase config keys (`interval`, `rate`,
`window`, `print_status`) but the examples still use `Interval`/`Rate`/`Window`,
creating inconsistency; update all example snippets on this page to use the
documented lowercase keys (`interval`, `rate`, `window`, `print_status`)
(replace occurrences of `Interval`, `Rate`, `Window`, and `PrintStatus` in the
examples) and verify pasted examples match the table and default values (e.g.,
`window` default 5) so copy-paste usage is correct.

In `@pipeline/filters/wasm.md`:
- Around line 66-69: Update the example keys to use the new snake_case names to
match the renamed table: replace Wasm_Path with wasm_path, Function_Name with
function_name, and Accessible_Paths with accessible_paths (also normalize
Event_Format to event_format if the rest of the doc uses snake_case). Ensure the
YAML/example block uses wasm_path, function_name, accessible_paths so it is
consistent with the renamed table and the other Wasm docs.

---

Outside diff comments:
In `@pipeline/filters/grep.md`:
- Around line 142-144: The classic config examples for the grep plugin use
Title_Case keys; update the plugin-specific keys in the grep examples to
lowercase (e.g., change Exclude -> exclude, Regex -> regex, Logical_Op ->
logical_op) so they match the parameter table and PR conventions; edit the grep
examples shown (the blocks containing "Name grep" and the other two examples
referenced) and replace those capitalized keys with the lowercase equivalents
while leaving values and surrounding structure intact.
- Around line 86-88: The example config uses lowercase framework keys but should
follow Title_Case for framework parameters: change "name" to "Name" and "match"
to "Match" while keeping the plugin-specific key "regex" lowercase; update the
example block that currently reads "name   grep / match  * / regex  log aa" to
use "Name" and "Match" to match other examples (retain "regex" as-is) so casing
is consistent with the rest of the document.

In `@pipeline/filters/kubernetes.md`:
- Around line 468-489: The kubernetes filter example uses Title_Case plugin keys
(e.g., Kube_URL, Kube_CA_File, Kube_Token_File, Use_Kubelet, Kubelet_Port,
Merge_Log, Buffer_Size) while the rest of the docs use snake_case; update those
keys in the kubernetes [FILTER] block to the snake_case equivalents (kube_url,
kube_ca_file, kube_token_file, use_kubelet, kubelet_port, merge_log,
buffer_size) so the example matches the documented schema for the kubernetes
filter and stays consistent with the table/YAML examples.

In `@pipeline/filters/parser.md`:
- Around line 9-14: The parameter table and classic config examples use
Title_Case keys but must be lowercase to match YAML examples and other docs;
replace `Key_Name`→`key_name`, `Parser`→`parser`, `Preserve_Key`→`preserve_key`,
and `Reserve_Data`→`reserve_data` in the parameter table and in all three
classic config example blocks so the keys are consistently lowercase
(`key_name`, `parser`, `preserve_key`, `reserve_data`) across parser.md (update
the parameter table entries and the three classic config examples).

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: fe2fc79d-9450-4aa0-acfc-7e702f7724e9

📥 Commits

Reviewing files that changed from the base of the PR and between 1481ad4 and c00dd18.

📒 Files selected for processing (20)

• pipeline/filters/aws-metadata.md
• pipeline/filters/checklist.md
• pipeline/filters/ecs-metadata.md
• pipeline/filters/expect.md
• pipeline/filters/geoip2-filter.md
• pipeline/filters/grep.md
• pipeline/filters/kubernetes.md
• pipeline/filters/log_to_metrics.md
• pipeline/filters/lua.md
• pipeline/filters/multiline-stacktrace.md
• pipeline/filters/nest.md
• pipeline/filters/nightfall.md
• pipeline/filters/parser.md
• pipeline/filters/record-modifier.md
• pipeline/filters/rewrite-tag.md
• pipeline/filters/sysinfo.md
• pipeline/filters/tensorflow.md
• pipeline/filters/throttle.md
• pipeline/filters/type-converter.md
• pipeline/filters/wasm.md

[eschabell]

@cosmo0920 and @patrick-stephens if you have time to review, please note this is bigger set of changes covering the entire filters doc section update.

[coderabbitai]

Actionable comments posted: 1

♻️ Duplicate comments (1)

pipeline/filters/multiline-stacktrace.md (1)

348-348: ⚠️ Potential issue | 🟡 Minor

Capitalize framework key Match on line 346, keep Mode lowercase for consistency.

Line 348 shows Mode in Title_Case, but this is inconsistent with the established standard for this PR. The parameter mode is a plugin-specific key (documented in lowercase in the parameter table at line 49, and shown in lowercase in the YAML example at line 337). According to the PR's convention, classic config examples should use Title_Case only for framework keys like Name and Match, while plugin-specific keys should remain lowercase.

✏️ Proposed fix for casing consistency

 [FILTER]
   Name                  multiline
   Match                 *
   multiline.key_content log
-  Mode                  partial_message
+  mode                  partial_message

Based on learnings: In the fluent-bit-docs repository, classic fluent-bit.conf examples use Title_Case for framework keys (Name, Match) while plugin-specific keys remain lowercase (mode, multiline.key_content, multiline.parser).

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pipeline/filters/multiline-stacktrace.md` at line 348, The config example has
inconsistent casing: ensure the framework key is Title_Case and plugin keys are
lowercase — change the framework key to "Match" (capitalized) where it appears
(reference the config example around the multiline stacktrace block and the key
currently using framework casing), and make the plugin-specific key "mode"
lowercase (replace any "Mode" Title_Case occurrences) so plugin keys like mode,
multiline.key_content, and multiline.parser remain lowercase while framework
keys like Name and Match stay Title_Case.

🧹 Nitpick comments (1)

pipeline/filters/grep.md (1)

204-206: Consider varying sentence structure for better readability.

Three successive sentences begin with "If", which slightly affects readability. Consider rephrasing to improve flow.

✍️ Suggested rewording for variety

-If you want to set multiple `regex` or `exclude`, you can use `logical_op` property to use logical conjunction or disjunction.
-
-If `logical_op` is set, setting both `regex` and `exclude` results in an error.
+You can set multiple `regex` or `exclude` entries by using the `logical_op` property for logical conjunction or disjunction.
+
+Note that when `logical_op` is set, specifying both `regex` and `exclude` results in an error.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pipeline/filters/grep.md` around lines 204 - 206, Several sentences in
pipeline/filters/grep.md that explain the `logical_op` behavior all start with
"If", hurting readability; rephrase those three consecutive sentences to vary
sentence openings and improve flow while preserving meaning — for example, start
one sentence with "When `logical_op` is set," another with "Setting both `regex`
and `exclude` causes an error," and use a different construction for the third —
ensure you reference the same symbols (`logical_op`, `regex`, `exclude`) so the
intent remains clear.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@pipeline/filters/aws-metadata.md`:
- Around line 84-96: The example Fluent Bit classic config for the aws filter
uses lowercase plugin-specific keys; update them to Title_Case to match project
convention: change imds_version, az, ec2_instance_id, ec2_instance_type,
private_ip, ami_id, account_id, hostname, vpc_id, tags_enabled to Imds_version,
Az, Ec2_instance_id, Ec2_instance_type, Private_ip, Ami_id, Account_id,
Hostname, Vpc_id, Tags_enabled in the [FILTER] Name aws block so the aws filter
example follows the same Title_Case style as other filters.

---

Duplicate comments:
In `@pipeline/filters/multiline-stacktrace.md`:
- Line 348: The config example has inconsistent casing: ensure the framework key
is Title_Case and plugin keys are lowercase — change the framework key to
"Match" (capitalized) where it appears (reference the config example around the
multiline stacktrace block and the key currently using framework casing), and
make the plugin-specific key "mode" lowercase (replace any "Mode" Title_Case
occurrences) so plugin keys like mode, multiline.key_content, and
multiline.parser remain lowercase while framework keys like Name and Match stay
Title_Case.

---

Nitpick comments:
In `@pipeline/filters/grep.md`:
- Around line 204-206: Several sentences in pipeline/filters/grep.md that
explain the `logical_op` behavior all start with "If", hurting readability;
rephrase those three consecutive sentences to vary sentence openings and improve
flow while preserving meaning — for example, start one sentence with "When
`logical_op` is set," another with "Setting both `regex` and `exclude` causes an
error," and use a different construction for the third — ensure you reference
the same symbols (`logical_op`, `regex`, `exclude`) so the intent remains clear.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 27eccaf6-6427-4bc8-acee-0202b8276ca5

📥 Commits

Reviewing files that changed from the base of the PR and between bbd5dc4 and 07ed7d4.

📒 Files selected for processing (4)

• pipeline/filters/aws-metadata.md
• pipeline/filters/grep.md
• pipeline/filters/multiline-stacktrace.md
• pipeline/filters/sysinfo.md

✅ Files skipped from review due to trivial changes (1)

• pipeline/filters/sysinfo.md