I'm trying to make filebeat send logs excluding some messages.
filebeat.prospectors: - input_type: log document_type: exchange paths: - d:\Program Files\Exchange Server 2013\TransportRoles\Logs\MessageTracking\MSGTRK*.LOG ignore_older: 336h processors: - drop_event: when: regexp: message: 'MicrosoftExchange.+@kirmarket\.ru' output: logstash: hosts: ["logs:5044"]
On start i get error:
Exiting: error initializing processors: each processor needs to have exactly one action, but found 2 actions
What is wrong? Where is the 2nd action?