Dropping logs in logstash

Elastic Stack Logstash
1

Is there any way where i can discard some logs from a log file in case, they match certain query?

for example, i have a log file test-sample.log which has these logs:

  1. abc failed due to something
  2. warning is generated
  3. abc failed due to something

so i want to take whole test-sample.log for log checking, but i want to forward only those lines which contain word "failed" (line 1 and 3 in this case) , to elasticsearch.

2

Use a drop filter and wrap it in a conditional.

if [fieldname] =~ /failed/ {
  drop { }
}
3

Wow, That helped. Thanks.

4

Does that work for regex comparisons too?

e.g.

if [fieldname] =~ /fa*/ {
drop { }
}

P.S. I am using logstash version 5.2.2.

5

Yes, see https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.