# Drop incoming messages **URL:** \ **Category:** Logstash\ **Created:** [August 2, 2021, 3:22pm UTC](https://discuss.elastic.co/t/drop-incoming-messages/280236 "2021-08-02T15:22:31Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![rosboc](https://avatars.discourse-cdn.com/v4/letter/r/74df32/32.png) [@rosboc](https://discuss.elastic.co/u/rosboc)\ **Post date:** [August 2, 2021, 3:22pm UTC](https://discuss.elastic.co/t/drop-incoming-messages/280236/1 "2021-08-02T15:22:31Z")
Hi, i am using logstash 6.1.1 with following configuration and need to drop messages containing "type= traffic" string and i am not able to get it working. ```auto input { udp { port => 2514 type => "syslog" codec => plain { charset => "ISO-8859-1" } tags => ["fg_syslog"] } } filter{ #ruby { code => "puts event.get('message')" } grok { match => ["message", "type=traffic"] add_tag => ["drop"] } } output { #stdout { codec => rubydebug } if ( ('fg_syslog' in [tags]) and !('drop' in [tags]) ) { # send to logstash_fortigate syslog{ host => "xxxxxx" port => "2514" protocol => "udp" } # send to QRadar fortigate_syslog_forwarder { host => "xxxxx" port => "514" } } } ``` These are type of log logs logstash is receiving in input ( you can notice small differences) : ```auto <181>Aug 2 10:05:39 df18.fcr01.dal09 date=2021-08-02 time=15:08:42 devname=df18-fcr01-dal09 devid=FG300C3913607629 logid=0000000013 type=traffic subtype=forward level=notice vd=firewall001 srcip=xxxxxxx srcport=36554 srcintf="v418-outside" dstip=xxxxxx dstport=10384 dstintf="v853-inside" poluuid=3555337c-1a66-51e9-0209-d11c3ea9350f sessionid=869404929 proto=6 action=deny policyid=65 dstcountry="United States" srccountry="United States" trandisp=noop service="tcp/10384" duration=0 sentbyte=0 rcvdbyte=0 sentpkt=0 appcat="unscanned" crscore=30 craction=131072 crlevel=high <190>date=2021-08-02 time=15:08:29 devname="dft04-pod01-wdc04" devid="FG15DTT918800110" logid="0100032001" type="event" subtype="system" level="information" vd="firewall001" eventtime=1627916909142565217 tz="+0000" logdesc="Admin login successful" sn="1627916909" user="rboccia" ui="ssh(169.55.26.68)" method="ssh" srcip=xxxxxx dstip=xxxxxx action="login" status="success" reason="none" profile="VDOM Administrator" msg="Administrator rboccia logged in successfully from ssh(xxxxxxx)” <189>date=2021-08-02 time=15:08:14 devname="dft01-pod01-dal09" devid="FG15DT3I16800226" logid="0000000013" type="traffic" subtype="forward" level="notice" vd="firewall001" eventtime=1627916895028549746 tz="+0000" srcip=xxxxx srcport=36249 srcintf="v862-f-outside" srcintfrole="lan" dstip=xxxxxxx dstport=37037 dstintf="v852-f-inside" dstintfrole="lan" sessionid=91798369 proto=6 action="deny" policyid=0 policytype="policy" service="tcp/37037" dstcountry="United States" srccountry="China" trandisp="noop" duration=0 sentbyte=0 rcvdbyte=0 sentpkt=0 appcat="unscanned" crscore=30 craction=131072 crlevel="high" ``` Any idea how to solve this problem ? Thanks. Rosboc ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 2, 2021, 4:43pm UTC](https://discuss.elastic.co/t/drop-incoming-messages/280236/2 "2021-08-02T16:43:42Z")
The last two messages have quotes around the word traffic, so the grok will not match. If you want to make the quotes optional you could use ``` if [message] =~ /type="?traffic"?/ { drop {} } ``` ---
**Author:** ![rosboc](https://avatars.discourse-cdn.com/v4/letter/r/74df32/32.png) [@rosboc](https://discuss.elastic.co/u/rosboc)\ **Post date:** [August 2, 2021, 4:55pm UTC](https://discuss.elastic.co/t/drop-incoming-messages/280236/3 "2021-08-02T16:55:12Z")
Hi, do i have to use only your instructions in the filter section and remove other ones also from output section ? Thanks ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 2, 2021, 4:57pm UTC](https://discuss.elastic.co/t/drop-incoming-messages/280236/4 "2021-08-02T16:57:05Z")
That is correct. ---
**Author:** ![rosboc](https://avatars.discourse-cdn.com/v4/letter/r/74df32/32.png) [@rosboc](https://discuss.elastic.co/u/rosboc)\ **Post date:** [August 2, 2021, 5:14pm UTC](https://discuss.elastic.co/t/drop-incoming-messages/280236/5 "2021-08-02T17:14:18Z")
It worked 🙂 is this correct ? ```auto filter{ #ruby { code => "puts event.get('message')" } if [message] =~ /type="?traffic"?/ { drop {} } if [message] =~ /perf-stats/ { drop {} } } ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 2, 2021, 5:22pm UTC](https://discuss.elastic.co/t/drop-incoming-messages/280236/6 "2021-08-02T17:22:17Z")
That looks OK to me. ---
**Author:** ![rosboc](https://avatars.discourse-cdn.com/v4/letter/r/74df32/32.png) [@rosboc](https://discuss.elastic.co/u/rosboc)\ **Post date:** [August 2, 2021, 5:22pm UTC](https://discuss.elastic.co/t/drop-incoming-messages/280236/7 "2021-08-02T17:22:44Z")
Perfect. Thank you very much ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 30, 2021, 5:22pm UTC](https://discuss.elastic.co/t/drop-incoming-messages/280236/8 "2021-08-30T17:22:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.