> For the complete documentation index, see [llms.txt](https://docs.fluentbit.io/manual/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fluentbit.io/manual/5.0/data-pipeline/filters/expect.md).

# Expect

{% hint style="info" %}
**Supported event types:** `logs`
{% endhint %}

The *expect* filter plugin lets you validate that records match certain criteria in their structure, like validating that a key exists or it has a specific value.

For a detailed explanation of its usage and use cases, see [Validating and your Data and Structure](/manual/5.0/local-testing/validating-your-data-and-structure.md).

## Configuration parameters

The plugin supports the following configuration parameters:

| Key                   | Description                                                                                                                                                                                                                                                                                                                                                                                              | Default   |
| --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- |
| `action`              | Action to take when a rule doesn't match. Available options are `warn`, `exit` or `result_key`. On `warn`, a warning message is sent to the logging layer for each record that fails a `key*` rule. Using `exit` makes Fluent Bit exit with status code `255`. `result_key` adds a matching result to each record. For how each action treats a batch of records, see [Batch behavior](#batch-behavior). | `warn`    |
| `key_exists`          | Check if a key with a given name exists in the record.                                                                                                                                                                                                                                                                                                                                                   | *none*    |
| `key_not_exists`      | Check if a key doesn't exist in the record.                                                                                                                                                                                                                                                                                                                                                              | *none*    |
| `key_val_eq`          | Check that the value of the key equals the given value in the configuration.                                                                                                                                                                                                                                                                                                                             | *none*    |
| `key_val_is_not_null` | Check that the value of the key is `NOT NULL`.                                                                                                                                                                                                                                                                                                                                                           | *none*    |
| `key_val_is_null`     | Check that the value of the key is `NULL`.                                                                                                                                                                                                                                                                                                                                                               | *none*    |
| `result_key`          | Specify a key name for the matching result added when `action` is set to `result_key`.                                                                                                                                                                                                                                                                                                                   | `matched` |

## Batch behavior

Fluent Bit delivers records to filters in batches. The expect filter evaluates each data record in a batch against your rules, and the configured `action` determines what happens next. Two exceptions apply across the batch: `exit` stops evaluation at the first record that fails a rule, and `result_key` never adds a result to marker records.

* `warn`: each record that fails a rule logs its own `expect check failed` warning. A batch that contains several failing records produces several warnings.
* `exit`: Fluent Bit stops at the first record that fails a rule and exits with status code `255`. The remaining records in the batch aren't evaluated.
* `result_key`: each record gets its own result. A record that passes every rule is marked `true`, and a record that fails any rule is marked `false`, so one failing record doesn't change the result recorded for the other records in the same batch.

Some event types, such as OpenTelemetry logs, include internal marker records that delimit a group of records. The expect filter passes these markers through unchanged and doesn't add the result key to them.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.fluentbit.io/manual/5.0/data-pipeline/filters/expect.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.