> For the complete documentation index, see [llms.txt](https://docs.fluentbit.io/manual/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fluentbit.io/manual/data-pipeline/filters/expect.md).

# Expect

Testing records to ensure they contain an expected key and values

{% hint style="info" %}
**Supported event types:** `logs`
{% endhint %}

The *expect* filter plugin lets you validate that records match certain criteria in their structure, like validating that a key exists or it has a specific value.

For a detailed explanation of its usage and use cases, see [Validating and your Data and Structure](/manual/local-testing/validating-your-data-and-structure.md).

## Configuration parameters

The plugin supports the following configuration parameters:

| Key                   | Description                                                                                                                                                                                                                                                                                                                                                                                              | Default   |
| --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- |
| `action`              | Action to take when a rule doesn't match. Available options are `warn`, `exit` or `result_key`. On `warn`, a warning message is sent to the logging layer for each record that fails a `key*` rule. Using `exit` makes Fluent Bit exit with status code `255`. `result_key` adds a matching result to each record. For how each action treats a batch of records, see [Batch behavior](#batch-behavior). | `warn`    |
| `key_exists`          | Check if a key with a given name exists in the record.                                                                                                                                                                                                                                                                                                                                                   | *none*    |
| `key_not_exists`      | Check if a key doesn't exist in the record.                                                                                                                                                                                                                                                                                                                                                              | *none*    |
| `key_val_eq`          | Check that the value of the key equals the given value in the configuration.                                                                                                                                                                                                                                                                                                                             | *none*    |
| `key_val_is_not_null` | Check that the value of the key is `NOT NULL`.                                                                                                                                                                                                                                                                                                                                                           | *none*    |
| `key_val_is_null`     | Check that the value of the key is `NULL`.                                                                                                                                                                                                                                                                                                                                                               | *none*    |
| `result_key`          | Specify a key name for the matching result added when `action` is set to `result_key`.                                                                                                                                                                                                                                                                                                                   | `matched` |

## Batch behavior

Fluent Bit delivers records to filters in batches. The expect filter evaluates each data record in a batch against your rules, and the configured `action` determines what happens next. Two exceptions apply across the batch: `exit` stops evaluation at the first record that fails a rule, and `result_key` never adds a result to marker records.

* `warn`: each record that fails a rule logs its own `expect check failed` warning. A batch that contains several failing records produces several warnings.
* `exit`: Fluent Bit stops at the first record that fails a rule and exits with status code `255`. The remaining records in the batch aren't evaluated.
* `result_key`: each record gets its own result. A record that passes every rule is marked `true`, and a record that fails any rule is marked `false`, so one failing record doesn't change the result recorded for the other records in the same batch.

Some event types, such as OpenTelemetry logs, include internal marker records that delimit a group of records. The expect filter passes these markers through unchanged and doesn't add the result key to them.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.fluentbit.io/manual/data-pipeline/filters/expect.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.