Drop filter for multiple names

Elastic Stack Logstash
1

Hi,

Could you please help me with drop logstash filter?
I have field 'username' and I want to drop all records for specific usernames.
Please correct my filter if it is wrong:

if ["Pete", "John", "Bill", "Greg", "Paul McCartney"] in [username] {
  drop { }
  }

Thanks.

2

Right now it's
"If the username contains this array ..."
That a) won't happen and b) isn't valid syntax in Logstash. (I think you can not define arrays directly in the conditions?)

Three possible solutions:

  1. If you had a field containing that array, you could probably write if [username] in [namelist]
  2. You could just concatenate all your conditions :if [username] == "Pete" or [username] == ...
  3. You could use a regular expression: if [username] =~ /Pete|John|Bill|Greg|Paul McCartney/
3 Likes
3

Thank you! It seems solution 2 is my choice!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.