Newbie to ELK Stack and Filebeat here. Managed to get log shipping from my linux hosts working fine and have 2x prospectors for my syslogs and secure logs as going to try filtering them in logstash differently.
Anyway, I have a service running on all servers (NRPE for Nagios) which puts syslog entries every couple of minutes which I don't want to include, but I cannot seem to get filebeat to exclude them. This is what I currently have.
- input_type: log paths: - /var/log/messages* - /var/log/syslog* exclude_files: [".gz$"] exclude_lines: ['.*nrpe.*', '.*Nrpe.*'] multiline: pattern: "^\\s" match: after fields: logtype: syslog_data
I've also tried
exclude_lines: ['[nN]rpe'] exclude_lines: [(?i)nrpe]
Any ideas what I'm doing wrong?