Drop event

Elastic Stack Logstash
1

I would like to drop particular events from a log message that coming from a socket input.
How can I do this?

2

Use a drop filter to drop an event and wrap the filter in a conditional to make sure you don't drop all events.

https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html

3

Thanks magnusbaeck.
If I use a grok filter like this:

if [type] == "syslog" {

grok {
match => [
"message", ".google."
]
add_tag => "to_drop"
}
}

When grok match I add a tag "to_drop" otherwise no.

It's correct?

4

That depends on what you want to accomplish. Drop all events whose message field contains "google"?

5

Yes. It's it. Thanks.

6 
if "google" in [message] {
  drop { }
}
7

Great! How can I log the dropped events? Maybe to check the first time if all work correctly.

8

I don't think there's a way of logging dropped events, but instead of dropping them you can add a tag and use the presence of that tag in the output section to conditionally log those events to a file rather than sending them to the usual outputs.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.