Mezmo UI exclusion rules apply after ingestion, filter at the agent instead

TL;DR

Use redaction templates for common PII patterns rather than trying to exclude everything after the fact. The 3.2 agent instead supports inclusion and exclusion rules plus redaction via regex patterns applied at the agent, so filtered logs never leave the host.

Steps

1. Do not rely on UI exclusion rules to control data egress or keep sensitive logs in house: move include/exclude regex rules and redaction to the agent config so unwanted lines never leave your systems. Use redaction templates for common PII patterns rather than trying to exclude everything after the fact. Re-check both the agent rules and the UI rules after upgrades, since the two layers behave differently.

When to use

You are seeing this: Do not rely on UI exclusion rules to control data egress or keep sensitive logs in house: move include/exclude regex rules and redaction to the agent config so unwanted lines never leave your systems. Use this skill when you run into "Mezmo UI exclusion rules apply after ingestion, filter at the agent instead".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Mezmo's Agent 3.2 announcement documents a cost and privacy trap in UI-side exclusion rules. Exclusion rules configured in the Mezmo UI are applied only after ingestion, which means customers still pay egress for the unneeded log data, and logs containing PII can leave their system of origin before being excluded. The 3.2 agent instead supports inclusion and exclusion rules plus redaction via regex patterns applied at the agent, so filtered logs never leave the host.

Verified resolution: Do not rely on UI exclusion rules to control data egress or keep sensitive logs in house: move include/exclude regex rules and redaction to the agent config so unwanted lines never leave your systems. Use redaction templates for common PII patterns rather than trying to exclude everything after the fact. Re-check both the agent rules and the UI rules after upgrades, since the two layers behave differently.

Source URL: https://www.mezmo.com/blog/announcing-logdna-agent-3-2-ga