# Drop logs from particular hostname

**URL:** <https://discuss.elastic.co/t/drop-logs-from-particular-hostname/137355>\
**Category:** Logstash\
**Created:** [June 26, 2018, 4:47am UTC](https://discuss.elastic.co/t/drop-logs-from-particular-hostname/137355 "2018-06-26T04:47:16Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tag\_v](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tag_v/32/47466_2.png) [@tag\_v](https://discuss.elastic.co/u/tag_v)\
**Post date:** [June 26, 2018, 4:47am UTC](https://discuss.elastic.co/t/drop-logs-from-particular-hostname/137355/1 "2018-06-26T04:47:16Z")

</div>

How to drop/ disable parsing logs from particular hosts using logstash? I have disabled hostdetails in a db table. How to make config file to make this happen? please suggest

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 26, 2018, 6:36am UTC](https://discuss.elastic.co/t/drop-logs-from-particular-hostname/137355/2 "2018-06-26T06:36:43Z")

</div>

You can wrap a drop filter in a conditional that checks the content of a field. Some examples:

> [@Drop some line when match in logstash](https://discuss.elastic.co/t/drop-some-line-when-match-in-logstash/80270):
>
> At the moment i have this filter working to drop some lines ## var\_log\_messages filter filter { if [type] == "var\_log\_messages" { grok { patterns\_dir =\> ["/etc/logstash/patterns/"] match =\> { "message" =\> "%{SYSLOGTIMESTAMP:var\_log\_messages\_timestamp} %{SYSLOGHOST:var\_log\_messages\_hostname} %{DATA:syslog\_program}(?:\[%{POSINT:var\_log\_secure\_pid}\])?: %{GREEDYDATA:message}" } overwrite…

> <https://stackoverflow.com/questions/27443392/how-can-i-have-logstash-drop-all-events-that-do-not-match-a-group-of-regular-exp>

> [@How to exclude bad output (lines not matching 'grok' pattern) from logstash?](https://discuss.elastic.co/t/how-to-exclude-bad-output-lines-not-matching-grok-pattern-from-logstash/40459):
>
> I have a log file and I am parsing it through Logstash and storing it in some place. But the the problem is that some lines in the log file do not always match my grok pattern and are therefore tagged as 'grokparsefailure' etc automatically. I do not tag any line explicitly, so the lines which are automatically tagged by logstash are the wrongly structured lines and I want these lines to be skipped i.e. I don't want these output lines to appear in the output at all (lines which have tags). Can …

> **[Accessing event data and fields | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html)**

---

<div class="post-metadata">

**Author:** ![tag\_v](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tag_v/32/47466_2.png) [@tag\_v](https://discuss.elastic.co/u/tag_v)\
**Post date:** [June 26, 2018, 8:14am UTC](https://discuss.elastic.co/t/drop-logs-from-particular-hostname/137355/3 "2018-06-26T08:14:53Z")

</div>

> [@magnusbaeck](#):
>
> You can wrap a drop filter in a conditional that checks the content of a field. Some examples:

You mean to say get db data where disable hostnames present, and compare log. if hostname is from one of the disabled hosts drop message else parse message. Correct me if i am wrong.

With this how can i hold data coming from jdbc filter for using them in filter block?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 26, 2018, 8:35am UTC](https://discuss.elastic.co/t/drop-logs-from-particular-hostname/137355/4 "2018-06-26T08:35:00Z")

</div>

> You mean to say get db data where disable hostnames present, and compare log. if hostname is from one of the disabled hosts drop message else parse message. Correct me if i am wrong.

No, that's right.

> With this how can i hold data coming from jdbc filter for using them in filter block?

The details depend on whether you use a jdbc\_static or a jdbc\_streaming filter, but the general idea is that the plugin stores data from the query in a field that you can access in a conditional in the filter section.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 24, 2018, 8:35am UTC](https://discuss.elastic.co/t/drop-logs-from-particular-hostname/137355/5 "2018-07-24T08:35:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.