Labels and routing

Labels are fields Sage adds to every event. They tell you later where an event came from without having to put that into every application's log format.

[labels]
env = "production"
role = "web"

#Labels per input

Labels can also be set on a single input, and they are added after the global ones, so they can override them. A common use is to mark which application wrote a file.

#Dropping events

Events can be dropped before they reach the outputs by matching on any field. Health checks and debug logs from busy services are the usual candidates; dropping them early saves bandwidth and storage further down the line.