Drop everything and only filter for specific fileds

Elastic Stack Logstash
1

In my config file I have a very long list of these drops:

                           if ([EventType]=="CachedRateDataStore"){
                                    drop { }
                    }
                           if ([EventType]=="ChronoStats"){
                                    drop { }

etc

I have also got a number of filters

( "PriceRequestProcessor" in [message]) or
( "PfPriceRequestRejectExecutor" in [message])
{
kv {
etc

I just realised that my "drop" list is growing long. In fact I'm not interested in any other fields except the ones I'm filtering with kv.

How do I drop just about everything and only apply filters the 2 fields up here. That stops me from having to explicitly drop spcecific fields. If the items aren't PriceRequestProcessor or PfPriceRequestRejectExecutor, then drop them all.

2

Perhaps

if [EventType] not in ["CachedRateDataStore", "ChronoStats"] {
  drop { }
}

is what you're looking for.

3

That will still mean I create a list ... I'm only interested in PriceRequestProcessor and PfPriceRequestRejectExecutor in message then drop everything else.

4

will this work?

If [ "PfPriceRequestRejectExecutor", "PriceRequestProcessor" ] not in [ message ] {
drop { }
}

5

This is confusing. Do you want to drop all messages except those with EventType being either CachedRateDataStore or ChronoStats and a message that contains PriceRequestProcessor or PfPriceRequestRejectExecutor?

6

Sorry Magnus

I meant to get rid of anything that doesn't have PriceRequestProcessor or PfPriceRequestRejectExecutor as eventType.

7

I think I figured it out with this:

if [EventType] not in ["PriceRequestProcessor","PfPriceRequestRejectExecutor","PriceRequestListener","DiscountPointRequestBlock","PfClientEnrichmentBlock"] {
drop { }

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.