# Creating drop filters based on a string search in a message field

**URL:** <https://discuss.elastic.co/t/creating-drop-filters-based-on-a-string-search-in-a-message-field/64050>\
**Category:** Logstash\
**Created:** [October 26, 2016, 7:26pm UTC](https://discuss.elastic.co/t/creating-drop-filters-based-on-a-string-search-in-a-message-field/64050 "2016-10-26T19:26:42Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 27, 2016, 1:00pm UTC](https://discuss.elastic.co/t/creating-drop-filters-based-on-a-string-search-in-a-message-field/64050/7 "2016-10-27T13:00:10Z")

</div>

There's nothing wrong with the filter. Perhaps you're not running with the configuration you expect?

```nohighlight
$ cat test.config 
input { stdin { } }
output { stdout { codec => rubydebug } }
filter {
  if "ASA-6-302013" in [message] { drop{ } }
}
$ ( echo 'first message' ; echo 'Oct 27 12:43:28 asa10 : %ASA-6-302013: Built inbound TCP connection 1033541997 for outside:10.150.0.0./46742 (10.150.0.0/46742) to inside.customer:172.26.0.0/8080 (161.215.0.0/8080)' ; echo 'third message' ) | /opt/logstash/bin/logstash -f test.config
Settings: Default pipeline workers: 8
Pipeline main started
{
       "message" => "first message",
      "@version" => "1",
    "@timestamp" => "2016-10-27T12:59:19.746Z",
          "host" => "lnxolofon"
}
{
       "message" => "third message",
      "@version" => "1",
    "@timestamp" => "2016-10-27T12:59:19.780Z",
          "host" => "lnxolofon"
}
Pipeline main has been shutdown
stopping pipeline {:id=>"main"}

```

---

_[View the full topic](https://discuss.elastic.co/t/creating-drop-filters-based-on-a-string-search-in-a-message-field/64050)._