# Drop messages that end with specific substring

**URL:** <https://discuss.elastic.co/t/drop-messages-that-end-with-specific-substring/279994>\
**Category:** Logstash\
**Created:** [July 29, 2021, 1:41pm UTC](https://discuss.elastic.co/t/drop-messages-that-end-with-specific-substring/279994 "2021-07-29T13:41:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bgingras](https://avatars.discourse-cdn.com/v4/letter/b/3ab097/32.png) [@bgingras](https://discuss.elastic.co/u/bgingras)\
**Post date:** [July 29, 2021, 1:41pm UTC](https://discuss.elastic.co/t/drop-messages-that-end-with-specific-substring/279994/1 "2021-07-29T13:41:20Z")

</div>

Hello everyone, I'm trying to implement a Logstash filter that drops syslogs messages that end with a specific substring, something like this:

```auto
filter {
   if [message].endsWith("substring") {
    drop {

    }
  }
}

```

Has anyone here implemented such a filter? If so can you please share with me how this can be done?

Thank you

---

<div class="post-metadata">

**Author:** ![Cad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cad/32/86661_2.png) [@Cad](https://discuss.elastic.co/u/Cad)\
**Post date:** [July 29, 2021, 2:11pm UTC](https://discuss.elastic.co/t/drop-messages-that-end-with-specific-substring/279994/2 "2021-07-29T14:11:53Z")

</div>

Hi,

I think the easiest way to do that is, like you suggest, with conditions.  
According to the [documentation](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals), you can use regexp in conditions. So, you have to create a regex who recognised every message who end with the `substring`, if the pattern match your message then drop the event.

```auto
if [message] =~ /^.*substring$/ {
  drop {}
}

```

Cad.

---

<div class="post-metadata">

**Author:** ![bgingras](https://avatars.discourse-cdn.com/v4/letter/b/3ab097/32.png) [@bgingras](https://discuss.elastic.co/u/bgingras)\
**Post date:** [July 29, 2021, 5:55pm UTC](https://discuss.elastic.co/t/drop-messages-that-end-with-specific-substring/279994/3 "2021-07-29T17:55:35Z")

</div>

I had to slightly modify the regex but this worked. Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 26, 2021, 5:56pm UTC](https://discuss.elastic.co/t/drop-messages-that-end-with-specific-substring/279994/4 "2021-08-26T17:56:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.