Drop message if tag is search and message has multiple strings

Elastic Stack Logstash
1

I am looking for dropping a message from the tag search if message has
the following strings.

if "WARN" in [message] { drop{ } }
if ".java:" in [message] { drop{ } }
if "has open connections " in [message]

How can I achieve this, will the below approach work

filter {
if "search" in [tags] and [message] =~ /(WARN|has open connections|.java:)/ { drop{} }
}

2

I would expect that to work.

3

No its not working.

Messages are not getting dropped.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.