I've a problem with my journalbeat config. I want to drop all events that have a syslog priority greater than 5 but nothing that has a process name with "nginx".
The config looks like this:
processors: - drop_event: when: range: syslog.priority.gt: 5 and.not.contains: process.name: "nginx"
I've tried so many things but it just dont want to work. When I remove the processor the logs are received. The constellation with drop everything with a priority greater than 5 but not nginx logs are not working togehter as it seems.
What am I doing wrong here?
Ok I got a workaround with setting the facility of syslog in the nginx config. But it would be still interesting to know why my config above doesnt work