Cribl 利用function 对parser 进行特殊过滤处理:

Parser Function – Fields Filter Expression​

When you use the Stream Parser Function's Reserialize option, there is a special option that becomes available, called the Fields Filter Expression. This is basically a filter expression that's used in determining whether a field gets included when the event is reserialized: