Monitor Filter Syntax

The search field on the Monitor page does more than find text. It understands a small filter language, so you can match exact KNX facts - group addresses, senders, telegram services, priority, hop count, decoded values - and combine them with AND, OR, and NOT. This page is the complete reference.

Applying a filter checks every telegram already in the monitor once; new telegrams are then checked as they arrive. The filter only changes what you see - nothing is deleted.

Quick examples

Let the pickers build filters for you

You don't have to type filters. The search button next to the field (group addresses and devices from your ETS project) and View → View Group in the badge row (addresses, telegram types, priority) create them for you - choosing a sender gives src:1.1.5, choosing Urgent gives priority:urgent, and so on.

If a filter is already active, SharKNX asks how to add the new one:

With AND or OR, the current filter is wrapped in parentheses so its meaning is kept - for example ga:1/2/* | ga:2/1/* plus Urgent with AND becomes:

(ga:1/2/* | ga:2/1/*) + priority:urgent

The result appears in the search field, so you can see it, edit it, and apply it again. Clear removes the filter and the text.

Text search

Plain text is a case-insensitive search across everything a row shows: source and destination address, group address name and description, telegram type, decoded value, payload hex, priority, and the labels of bus events.

read

This is deliberately broad - it matches a GroupValueRead, a group address named Read request, or a value containing read. For an exact telegram type, use apci: instead.

Spaces don't mean AND. living room searches for the phrase living room. To combine two conditions, use +.

Group addresses: ga:

1/2/3
1/2/*
ga:1/*/*
1/515

A bare group address works on its own; the ga: prefix makes it explicit, which is clearer in longer filters. ga: only matches telegrams sent to a group address.

• 3-level: main 0-31, middle 0-7, sub 0-255
• 2-level: main 0-31, sub 0-2047
• A wildcard * must replace a whole part: 1/2/* works, 1/2/2* does not.

Matching uses the address's raw value, so 1/2/3 and 1/515 are the same address - switching the display between 2-level and 3-level never changes the results.

Senders: src:

1.1.5
1.1.*
src:1.*.*

A bare individual address works on its own; src: makes it explicit. It always matches the sender of a telegram, never its destination.

• Area 0-15, line 0-15, device 0-255
• A wildcard * must replace a whole part.

Telegram type: apci:

apci:GroupValueRead
apci:GroupValueResponse
apci:GroupValueWrite

Use the full service name - capitalisation doesn't matter, but apci:read is rejected. For a service without a name, use its code in hexadecimal, from 0x0 to 0x3FF:

apci-code:0x155

Priority and hop count

priority:system
priority:urgent
priority:normal
priority:low
hop:3

KNX's high priority is called urgent - priority:high is rejected. Hop count is a whole number from 0 to 7.

Decoded values: value

value>20
value<20
value>=20
value<=20
value>=-2.5

• Only telegrams with a decoded numeric value match - load your ETS project so values can be decoded.
• Use a dot for decimals (1.5), whatever your phone's language.
• No units, no scientific notation (1e3), and no = - for an exact value use value>=20 + value<=20.
• Values are compared as numbers, whatever their datapoint type, so combine a value condition with a group address to keep its meaning clear:

ga:1/2/3 + value>=20

Bus events: kind:

Besides telegrams, the monitor records other observations. Filter them by kind:

Spaces, hyphens, underscores, and capitalisation don't matter: kind:Bus Control works too.

Combining conditions

NOT binds strongest, then AND, then OR. So:

kind:gap | priority:urgent + hop:3

means a gap, or an urgent telegram with hop count 3. When in doubt, add parentheses:

ga:1/2/* + (apci:GroupValueWrite | apci:GroupValueResponse)
(src:1.1.* | src:1.2.*) + value>=20

!(value>20) also shows rows without a decoded value, because NOT simply inverts the result.

Searching for special characters

To search for text containing +, |, !, or parentheses, put it in double quotes:

"Alarm + Hall"
"Status (North)"

Write a quote inside a quoted text as \", and a backslash as \\. Quotes also force a plain text search for anything that looks like a filter, such as "unknown:value".

When a filter is rejected

If a filter can't be understood, SharKNX shows the error and its position below the search field. The last valid filter stays active, so the list doesn't change until you fix the text and apply it again.

A valid filter shows nothing?

• Is the address a sender (src:) or a group address (ga:)?
• Do the telegrams have a decoded value? Load the ETS project.
• Is the apci: name complete?
• Does AND/OR need parentheses?
• 1/2/3 1.1.5 is one text search, not two conditions - write ga:1/2/3 + src:1.1.5.

Not the same as Shark Hunt filters

Shark Hunt Custom Monitor actions use conditions you build in a form (up to 10, joined with AND or OR), not this typed syntax. See Create a Shark Hunt.