Drop messages to log

Elastic Stack Elasticsearch
1

Hi!

I have a lot of documents saved in each minute because of LB of Google, the messages are like that:
10.xx.xx.xx - - [12/Mar/2020:16:08:20 +0000] "GET / HTTP/1.1" 200 7487 "-" "GoogleHC/1.0" "-"

After investigate this kind of messages are normal, so I have to find some way no avoid this message in my elasticsearch

I'm using filebeat to send logs inside my kubernetes cluster to elastic.

Is there any way to not log this kind of message?

Thank you very much!

2

You could use the drop_event processor of filebeat, if a the user agent is set to a certain agent. See https://www.elastic.co/guide/en/beats/functionbeat/7.6/defining-processors.html#conditions

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.