# Exclude a log line that matches an exclude\_line

**URL:** <https://discuss.elastic.co/t/exclude-a-log-line-that-matches-an-exclude-line/52349>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 9, 2016, 3:39pm UTC](https://discuss.elastic.co/t/exclude-a-log-line-that-matches-an-exclude-line/52349 "2016-06-09T15:39:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Zfs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zfs/32/13370_2.png) [@Zfs](https://discuss.elastic.co/u/Zfs)\
**Post date:** [June 9, 2016, 3:39pm UTC](https://discuss.elastic.co/t/exclude-a-log-line-that-matches-an-exclude-line/52349/1 "2016-06-09T15:39:38Z")

</div>

I have a more complex use case for include and exlude lines.

I'd like to log all lines not matched by exclude\_lines but also have the ability to over ride an exclude\_line.

Example:

exclude\_lines: ["^[0-9]_\/[0-9]_\/[0-9]\* [0-9]_:[0-9]_:[0-9]_.[0-9]_ [A-Z]\*: \[SPECIAL] special"]

Log Normal lines:  
06/04/16 10:22:25.286 INFO: [AAA] XXXX  
06/04/16 10:22:25.286 INFO: [BBB] XXXX  
06/04/16 10:22:25.286 FINE: [AAAAA] YYYY

But also log this line which would be excluded based on the above exclude line.  
["^[0-9]_\/[0-9]_\/[0-9]\* [0-9]_:[0-9]_:[0-9]_.[0-9]_ [A-Z]\*: \[SPECIAL] special"] - EXCEPTION: xxxx xxxx xxxxx xxxx

Thanks

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [June 10, 2016, 6:23am UTC](https://discuss.elastic.co/t/exclude-a-log-line-that-matches-an-exclude-line/52349/2 "2016-06-10T06:23:57Z")

</div>

I don't think this is possible right now, but the easiest solution so make your first regexp long so it matches all lines except the one with "EXCEPTION". Potentially things like this can be done with the more advanced filters in 5.0.0: [https://www.elastic.co/guide/en/beats/filebeat/master/configuration-filter.html](https://www.elastic.co/guide/en/beats/filebeat/master/configuration-filter.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 30, 2016, 3:40pm UTC](https://discuss.elastic.co/t/exclude-a-log-line-that-matches-an-exclude-line/52349/3 "2016-06-30T15:40:11Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.