Drop filter in Logstash filter not working for the below event

Elastic Stack Logstash
1

Event in Logstash :

{
      "timestamp" => "2023-09-13T05:10:52.527038098Z",
       "user" => "admin",
       "type" => "icd_postgresql",
       "status" => "INSERT INTO t1 SELECT i/100, i/500   FROM generate_series(1,1000000) s(i);",
      "ID1" => "00000",
      "@version" => "1",
      "accountId" => "2212c4a700f44505a917e8fcb952c4ce",
      "dbname" => "ibmclouddb",
      "detail" => ":b6abb2aa-ef85-494e-a174-12cd7223d9e7",
      "clientIP" => "172.30.12.192",
      "timezone" => "UTC",
      "statement" => "STATEMENT"
}

Filter for drop this event:

filter {
if [ID1] == "00000" and [statement] == "STATEMENT"
{
 drop {}
}
}
2

That conditional drop works for me. Maybe your event does not look the way you think it does.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.