Drop messages that end with specific substring

Elastic Stack Logstash
1

Hello everyone, I'm trying to implement a Logstash filter that drops syslogs messages that end with a specific substring, something like this:

filter {
   if [message].endsWith("substring") {
    drop {

    }
  }
}

Has anyone here implemented such a filter? If so can you please share with me how this can be done?

Thank you

2

Hi,

I think the easiest way to do that is, like you suggest, with conditions.
According to the documentation, you can use regexp in conditions. So, you have to create a regex who recognised every message who end with the substring, if the pattern match your message then drop the event.

if [message] =~ /^.*substring$/ {
  drop {}
}

Cad.

1 Like
3

I had to slightly modify the regex but this worked. Thank you!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.