•Inclusive mode logs only explicitly specified items. 

•Exclusive mode logs everything but explicitly specified items. 

To perform inclusive logging, disable logging globally and enable logging for specific classes. This filter logs connect  and disconnect  events in the connection  class, and events in the general  class: 

{ "filter": { "log": false, "class": [ { "name": "connection", "event": [ { "name": "connect", "log": true }, { "name": "disconnect", "log": true } ] }, { "name": "general", "log": true } ] } } 

To perform exclusive logging, enable logging globally and disable logging for specific classes. This filter logs everything except events in the general  class: 

{ "filter": { "log": true, "class": { "name": "general", "log": false } } } 

This filter logs change_user  events in the connection  class, message  events, and table_access events, by virtue of not  logging everything else: 

## Testing Event Field Values 

{ "filter": { "log": true, "class": [ { "name": "connection", "event": [ { "name": "connect", "log": false }, { "name": "disconnect", "log": false } ] }, { "name": "general", "log": false } ] } } 

To enable logging based on specific event field values, specify a field  item within the log  item that indicates the field name and its expected value: 

{ "filter": { "class": { "name": "general", "event": { 

