Drop event

I would like to drop particular events from a log message that coming from a socket input.
How can I do this?

Use a drop filter to drop an event and wrap the filter in a conditional to make sure you don't drop all events.


Thanks magnusbaeck.
If I use a grok filter like this:

if [type] == "syslog" {

grok {
match => [
"message", ".google."
add_tag => "to_drop"

When grok match I add a tag "to_drop" otherwise no.

It's correct?

That depends on what you want to accomplish. Drop all events whose message field contains "google"?

Yes. It's it. Thanks.

if "google" in [message] {
  drop { }

Great! How can I log the dropped events? Maybe to check the first time if all work correctly.

I don't think there's a way of logging dropped events, but instead of dropping them you can add a tag and use the presence of that tag in the output section to conditionally log those events to a file rather than sending them to the usual outputs.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.