# Drop filter is not working for certain string

**URL:** <https://discuss.elastic.co/t/drop-filter-is-not-working-for-certain-string/214901>\
**Category:** Logstash\
**Created:** [January 13, 2020, 9:03pm UTC](https://discuss.elastic.co/t/drop-filter-is-not-working-for-certain-string/214901 "2020-01-13T21:03:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![hadars](https://avatars.discourse-cdn.com/v4/letter/h/4bbf92/32.png) [@hadars](https://discuss.elastic.co/u/hadars)\
**Post date:** [January 13, 2020, 9:03pm UTC](https://discuss.elastic.co/t/drop-filter-is-not-working-for-certain-string/214901/1 "2020-01-13T21:03:06Z")

</div>

Hi,

I am trying to apply filter only if message has certain string.  
For example my message has "skipping L1 entity store" and my config looks like,

```auto
filter {
    if [msg] == "skipping L1 entity store" {
          drop { }
    }
}

```

i tried -

```auto
if "skipping L1 entity store" in [msg]

```

as well

Maybe it's the spaces?  
i'm sure that the data is in the field called [msg], i have a lot of filters and this is the only one that i can't make it to work, sapces is the only thing i have on this string that i do not have on the others..do i need to escape them in any way?

Condition is not working at all. Please help me to use condition to check above mentioned string in  
Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 13, 2020, 9:50pm UTC](https://discuss.elastic.co/t/drop-filter-is-not-working-for-certain-string/214901/2 "2020-01-13T21:50:20Z")

</div>

Spaces are not special. Can you use

```
 output { stdout { codec => rubydebug } }

```

and show us what [msg] looks like? (Or copy it from the JSON tab in the Kibana Discover view.)

---

<div class="post-metadata">

**Author:** ![hadars](https://avatars.discourse-cdn.com/v4/letter/h/4bbf92/32.png) [@hadars](https://discuss.elastic.co/u/hadars)\
**Post date:** [January 13, 2020, 10:20pm UTC](https://discuss.elastic.co/t/drop-filter-is-not-working-for-certain-string/214901/3 "2020-01-13T22:20:43Z")

</div>

this is how the log looks like.. i removed some data that is restricted (:

```auto
{
  "_index": "something",
  "_type": "_doc",
  "_id": "xC46oG8BsHImsQ9uMdas",
  "_version": 1,
  "_score": null,
  "_size": 2075,
  "_source": {
    "docker": {
      "container": {
        "id": "bla"
      }
    },
    "anchor": "something",
    "prospector": {
      "type": "log"
    },
    "@version": "1",
    "host_env": "some env",
    "msg": "skipping L1 entity store",
    "delta": 1
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 13, 2020, 11:29pm UTC](https://discuss.elastic.co/t/drop-filter-is-not-working-for-certain-string/214901/4 "2020-01-13T23:29:09Z")

</div>

I cannot explain why that if statement would not match that event.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 10, 2020, 11:38pm UTC](https://discuss.elastic.co/t/drop-filter-is-not-working-for-certain-string/214901/5 "2020-02-10T23:38:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.