Drop filter is not working for certain string


I am trying to apply filter only if message has certain string.
For example my message has "skipping L1 entity store" and my config looks like,

filter {
    if [msg] == "skipping L1 entity store" {
          drop { }

i tried -

if "skipping L1 entity store" in [msg]

as well

Maybe it's the spaces?
i'm sure that the data is in the field called [msg], i have a lot of filters and this is the only one that i can't make it to work, sapces is the only thing i have on this string that i do not have on the others..do i need to escape them in any way?

Condition is not working at all. Please help me to use condition to check above mentioned string in

Spaces are not special. Can you use

 output { stdout { codec => rubydebug } }

and show us what [msg] looks like? (Or copy it from the JSON tab in the Kibana Discover view.)

this is how the log looks like.. i removed some data that is restricted (:

  "_index": "something",
  "_type": "_doc",
  "_id": "xC46oG8BsHImsQ9uMdas",
  "_version": 1,
  "_score": null,
  "_size": 2075,
  "_source": {
    "docker": {
      "container": {
        "id": "bla"
    "anchor": "something",
    "prospector": {
      "type": "log"
    "@version": "1",
    "host_env": "some env",
    "msg": "skipping L1 entity store",
    "delta": 1

I cannot explain why that if statement would not match that event.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.