Exclude line regex wont work

Elastic Stack Beats
1

Hi,

I trying to exclude lines from the logs.
Some lines from the log:
Connect from 192.168.3.6:54422 to 192.168.3.2:3306 (mysql/TCP)
[26/Sep/2017:00:19:50 +0200] 94.0.38.45 - - "" 408 160 "" "" 58010 859 "www~" "www" "" -1 -1 -1 -1 600124 cR-- 200 200 0 0 0 0 0
Connect from 192.168.3.14:60552 to 192.168.3.2:3306 (mysql/TCP)
Connect from 192.168.3.6:34000 to 192.168.3.2:11211 (couchbase/TCP)
[26/Sep/2017:00:31:18 +0200] 82.112.195.218 - - "GET /index.php HTTP/1.1" 200 2965 "" "" 20429 864 "www" "www_servers" "MOON" 21 0 0 175 196 --NI 199 199 10 11 0 0 0

My regex from filebeat.yml
exclude_lines: ['^Connect']

As you can see on playground ( https://play.golang.org/p/5O2geFTGhg ) it works fine, but on my test server it wont exclude those lines.

What I'm missing?

Thanks Robert

2

Please share your config file (use three backticks before and after to get proper formatting [it's markdown]). What version are you using?

3

Hi, I'm using: filebeat version 5.6.1 (amd64), libbeat 5.6.1

filebeat.prospectors:
- input_type: log
  paths:
    - /var/log/archive/2017/lb0?/haproxy/??/192.168.3.2?.haproxyinflog.??

exclude_lines: ['^Connect']

#----------------------------- Logstash output --------------------------------
output.logstash:
  hosts: ["localhost:5043"]


#================================ Logging =====================================
logging.level: info
logging.selectors: ["*"]
4

The exclude_lines option should be indented another two spaces, so that it applies to the prospector, not global.

5

Thanks, that solved my problem.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.