Exclude_line regex

Elastic Stack Beats
1

NetState 47880 2018/12/20 08:44:02.422 StateManagerComponent ERROR - ProcessConfirmBlock - Unknown blockUid

Does anyone know how to match by regex:

StateManagerComponent	ERROR - ProcessConfirmBlock - Unknown blockUid
2

If you know it's this plain string you want to match against, just add the string as is to the exclude_lines setting.

3

I did, but Filebeat doesn't seem to recognize it. As it doesn't exclude this line:

exclude_lines: ['.*TRANSIENT_ConnectFailed.*']

This log line won't get excluded:

CORBA Exception is: name="TRANSIENT" minorCode=1096024066 minorCodeString="TRANSIENT_ConnectFailed" completed=NO

4

The exclude_lines of my last post only works if none other exclude lines are used... What am I supposed to do? I have over 50 strings that I want to exclude, but I can't make it work for all of them.

Any suggestions? This exclude_lines configuration is killing me...

Thanks!

5

Do you have some more complete sample?

I think it should work, unless you have some accidental overlap. When exclude_lines is configured each pattern is checked against the line. If one matches, then the line is dropped.

so to make it a little more readable/manageable better use list syntax:

filebeat.inputs:
- type: log
  ...
  exclude_lines:
  - 'TRANSIENT_ConnectFailed'  #  no need for .*
  - '<pattern2>'
  - '<pattern3>'
6

Is it possible to use the list syntax with more than one pattern per line?

It is working with the list syntax! Thanks!

7

Unfortunately not. If two patterns are very similar one can use an or expression like: - '(regex1)|(regex2)' or - '^common start ((regex1)|(regex2)) more common pattern'.

1 Like
8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.