Logback lets you suppress a log event with a logger level, a TurboFilter on the context, or a Filter attached to an appender. Explain where each one runs, what it can see, and how you would use them to keep one noisy MDC-tagged request at DEBUG while everything else stays at WARN.

## Why three mechanisms exist They answer different questions. *Should this call cost anything at all?* is the level. *Should this particular request or user be treated differently, globally?* is a TurboFilter. *Should this destination receive this event?* is an appender filter. Confusing them produces both performance surprises and configurations that quietly do nothing. ## Level: the cheap gate The effective level check is a comparison of two ints on the fast path of `isDebugEnabled`-style logic. Crucially it happens before the event object exists, so a disabled call never allocates and never calls `toString()` on arguments — provided the parameterised form is used. Every other mechanism costs strictly more, which is why the level remains the primary throughput control. ## TurboFilter: global, pre-level, sees raw inputs A `TurboFilter` is added to the context (`<turboFilter class="..."/>`) rather than to a logger or an appender. It is invoked for **every** logging call in the application, before the level test, and receives the un-built inputs: `Marker`, `Logger`, `Level`, the message pattern, the argument array and the `Throwable`. It has full access to the MDC because the MDC lives on the thread. That position gives it the one power nothing else has: `FilterReply.ACCEPT` **forces** the event through even though the logger's level would have rejected it. This is the basis of *conditional verbose logging*: root stays at WARN, but a request whose MDC carries `traceDebug=true` (set at the edge for a specific tenant, user or sampled request) emits DEBUG for that thread only. The built-in `MDCFilter` and `MarkerFilter` do exactly this; `DuplicateMessageFilter` is another built-in that suppresses repeats of the same message pattern. The cost is symmetric with the power: this code runs on every call in the process, including the ones the level would have discarded for free. Keep it to a map lookup — a regex over the formatted message, or anything allocating, turns your cheapest path into your most expensive one. ## Appender filters: per-destination, post-build Filters attached to an `<appender>` run after the event exists and after it has been routed there by the additivity walk. They vote: - `DENY` — drop immediately, no later filter consulted. - `ACCEPT` — write immediately, skipping remaining filters. Note this does *not* resurrect an event the level already killed; it only short-circuits the rest of this chain. - `NEUTRAL` — continue; if the whole chain is neutral, the event is written. Canonical uses: `LevelFilter` with `onMatch=ACCEPT`/`onMismatch=DENY` to send exactly ERROR to a separate file; `ThresholdFilter` to keep console terse while the file keeps everything; `EvaluatorFilter` wrapping a `JaninoEventEvaluator` for an expression over the event, or a `OnMarkerEvaluator` for marker-based routing. A useful mental rule: **filters restrict, they cannot expand** — except for a TurboFilter's ACCEPT, which is the only upward override in the system. ## Putting it together for per-request DEBUG At the trust boundary, set an MDC key when a request qualifies (an internal header, a sampling decision, a tenant allow-list — never a client-controlled flag taken on faith, or you have handed an attacker a log-volume amplifier). Configure a TurboFilter matching that key/value with `onMatch=ACCEPT`. Leave root at WARN. Optionally add a `ThresholdFilter` on the console appender so the forced DEBUG lines land only in the file. Because the MDC is copied into the event at creation, the lines carry the correlation key, and the whole request is retrievable downstream. The two failure modes to name: forgetting that the MDC is thread-bound (an async handoff loses it unless the value is propagated explicitly), and putting the rule on an appender filter, where the level check has already discarded the event and nothing appears at all.