Filter syntax - httpmon

Press / in the flow list to focus the filter bar. Type your filter expression and results update in real time.

Quick filter

Type any text to do a case-insensitive substring match on the host and path of each flow. No prefix needed.

api.example

This matches any flow whose host+path contains “api.example”.

Advanced expressions

Use a prefix to filter by a specific field.

Prefix	Description	Example
`s:CODE`	Status code (exact or range)	`s:200`, `s:2xx`
`m:METHOD`	HTTP method	`m:GET`, `m:POST`
`ct:TYPE`	Content-type substring	`ct:json`, `ct:html`
`re:PATTERN`	Regex on host+path	`re:api/v[0-9]+`
`!EXPR`	Negate any expression	`!s:4xx`, `!m:OPTIONS`

Separate multiple terms with spaces. All terms are ANDed together.

s:2xx m:GET ct:json

This matches flows that have a 2xx status, use GET, and return JSON.

Status code ranges

The s: prefix supports both exact codes and ranges using the Nxx format.

s:200 matches only 200 OK.
s:2xx matches any status from 200 to 299.
s:4xx matches any status from 400 to 499.
s:5xx matches any status from 500 to 599.

Examples

Filter	Matches
`api.example`	URLs containing “api.example”
`s:200`	200 OK responses
`s:2xx`	All 2xx responses
`m:POST`	POST requests only
`ct:json`	JSON content-type
`re:api/v[0-9]+`	Versioned API paths
`!s:4xx`	Exclude 4xx errors
`s:2xx m:GET ct:json`	2xx GET requests with JSON