# Drop message based on lookup table content? **URL:** \ **Category:** Logstash\ **Created:** [December 28, 2018, 2:05pm UTC](https://discuss.elastic.co/t/drop-message-based-on-lookup-table-content/162352 "2018-12-28T14:05:54Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![andre22](https://avatars.discourse-cdn.com/v4/letter/a/d07c76/32.png) [@andre22](https://discuss.elastic.co/u/andre22)\ **Post date:** [December 28, 2018, 2:05pm UTC](https://discuss.elastic.co/t/drop-message-based-on-lookup-table-content/162352/1 "2018-12-28T14:05:54Z")
Hi all, I want to drop some messages in Logstash when they contain specific strings, which I would like to maintain in a separate file so I can edit this as needed. An example: the field "syslog\_message" contains (or equals) "Started Proxmox VE replication runner." or "domain" is "[bookmarks.fe.apple-dns.net](http://bookmarks.fe.apple-dns.net) ". How can this be done? Thank you andre ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 28, 2018, 9:49pm UTC](https://discuss.elastic.co/t/drop-message-based-on-lookup-table-content/162352/2 "2018-12-28T21:49:16Z")
The three ways I can think of this are; 1. Just add it to the config and then use dynamic reloading 2. Use a translate table lookup to add a tag you can then conditionally drop 3. Do the same thing as 2, but use an Elasticsearch index to look it up ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 25, 2019, 10:01pm UTC](https://discuss.elastic.co/t/drop-message-based-on-lookup-table-content/162352/3 "2019-01-25T22:01:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.