Can filebeat pick up log entries based on keywords?

Elastic Stack Beats
1

Is it possible for filebeat to pick up only certain log entries?

For ex, if my log entry contains the following:

[2019-07-21:00:00:00] [INFO] [log message]

[2019-07-21:00:00:01] [ERROR] [log message]

Can I tell filebeat to pick up only the "ERROR" event?

Any help is appreciated!

Thanks

2

Don't know how performand it is but there is a n include_lines option in the configuration of the log input

see
https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-include-lines

3

Thanks! I'll try this out.