# Drop logs that does not contains type syslog

**URL:** <https://discuss.elastic.co/t/drop-logs-that-does-not-contains-type-syslog/207094>\
**Category:** Logstash\
**Created:** [November 8, 2019, 10:56am UTC](https://discuss.elastic.co/t/drop-logs-that-does-not-contains-type-syslog/207094 "2019-11-08T10:56:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jiri\_Safar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jiri_safar/32/44982_2.png) [@Jiri\_Safar](https://discuss.elastic.co/u/Jiri_Safar)\
**Post date:** [November 8, 2019, 10:56am UTC](https://discuss.elastic.co/t/drop-logs-that-does-not-contains-type-syslog/207094/1 "2019-11-08T10:56:47Z")

</div>

Hi,

I have a multiple input and output:

1. input is gelf and output for that is log that in to elastic.

2. input is a syslog and output is in to elastic.

But what hapens is that some gelf are send in to my syslog output. Is there option how to define on syslog output that if the log that is send on this output is not in type syslog drop it?

Can I somehow define that these seccond output is only for syslog logs?

Thanks

---

<div class="post-metadata">

**Author:** ![Justin\_Doles](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/justin_doles/32/40730_2.png) [@Justin\_Doles](https://discuss.elastic.co/u/Justin_Doles)\
**Post date:** [November 8, 2019, 11:19am UTC](https://discuss.elastic.co/t/drop-logs-that-does-not-contains-type-syslog/207094/2 "2019-11-08T11:19:20Z")

</div>

Your best bet would be to use tags. Type is not reliable for this specific use case.

```
input {
	udp {
		port => 5515
		tags => ["syslog"]
	}
	gelf {
		tags => ["gelf"]
	}
}

filter {}

output {
	# if you want to use different indices
	if "syslog" in [tags] {
		elasticsearch {
			hosts => []
			index => "syslog-%{+YYYY.MM.dd}"
			user => "elastic"
			password => "PASSWORD"
		}
	}
	if "gelf" in [tags] {
		elasticsearch {
			hosts => []
			index => "gelf-%{+YYYY.MM.dd}"
			user => "elastic"
			password => "PASSWORD"
		}
	}
}
```

---

<div class="post-metadata">

**Author:** ![Jiri\_Safar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jiri_safar/32/44982_2.png) [@Jiri\_Safar](https://discuss.elastic.co/u/Jiri_Safar)\
**Post date:** [December 2, 2019, 9:44pm UTC](https://discuss.elastic.co/t/drop-logs-that-does-not-contains-type-syslog/207094/3 "2019-12-02T21:44:37Z")

</div>

Hi,

thank you very much this solved my problem.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 30, 2019, 9:45pm UTC](https://discuss.elastic.co/t/drop-logs-that-does-not-contains-type-syslog/207094/4 "2019-12-30T21:45:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.