Appeared _grokparsefailure, unable to parse specific lines from log file

I have this kind of log:
I would like to drop all events except the lines with "INFO -- :". Logs are gathered by filebeat and then they are send to logstash. Important data are in log inside fields -> deviceId, productId, lang_from, lang_to, text. I tried different combination in filebeat: Here are config files and patterns:
Currently in Kibana I don't get what I want to have and moreover I got in tags (first one is always but second one appeared):
"beats_input_codec_plain_applied, _grokparsefailure"

Honestly I stucked.

How to drop many events if
- drop_event: when: regexp: message: "^D,"
allow only one type of "message"?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.