Drop filter is not working for certain string

Elastic Stack Logstash
1

Hi,

I am trying to apply filter only if message has certain string.
For example my message has "skipping L1 entity store" and my config looks like,

filter {
    if [msg] == "skipping L1 entity store" {
          drop { }
    }
}

i tried -

if "skipping L1 entity store" in [msg]

as well

Maybe it's the spaces?
i'm sure that the data is in the field called [msg], i have a lot of filters and this is the only one that i can't make it to work, sapces is the only thing i have on this string that i do not have on the others..do i need to escape them in any way?

Condition is not working at all. Please help me to use condition to check above mentioned string in
Thanks

2

Spaces are not special. Can you use

 output { stdout { codec => rubydebug } }

and show us what [msg] looks like? (Or copy it from the JSON tab in the Kibana Discover view.)

3

this is how the log looks like.. i removed some data that is restricted (:

{
  "_index": "something",
  "_type": "_doc",
  "_id": "xC46oG8BsHImsQ9uMdas",
  "_version": 1,
  "_score": null,
  "_size": 2075,
  "_source": {
    "docker": {
      "container": {
        "id": "bla"
      }
    },
    "anchor": "something",
    "prospector": {
      "type": "log"
    },
    "@version": "1",
    "host_env": "some env",
    "msg": "skipping L1 entity store",
    "delta": 1
}
4

I cannot explain why that if statement would not match that event.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.