Exclude_line regex

NetState 47880 2018/12/20 08:44:02.422 StateManagerComponent ERROR - ProcessConfirmBlock - Unknown blockUid

Does anyone know how to match by regex:

StateManagerComponent	ERROR - ProcessConfirmBlock - Unknown blockUid

If you know it's this plain string you want to match against, just add the string as is to the exclude_lines setting.

I did, but Filebeat doesn't seem to recognize it. As it doesn't exclude this line:

exclude_lines: ['.*TRANSIENT_ConnectFailed.*']

This log line won't get excluded:

CORBA Exception is: name="TRANSIENT" minorCode=1096024066 minorCodeString="TRANSIENT_ConnectFailed" completed=NO

The exclude_lines of my last post only works if none other exclude lines are used... What am I supposed to do? I have over 50 strings that I want to exclude, but I can't make it work for all of them.

Any suggestions? This exclude_lines configuration is killing me...


Do you have some more complete sample?

I think it should work, unless you have some accidental overlap. When exclude_lines is configured each pattern is checked against the line. If one matches, then the line is dropped.

so to make it a little more readable/manageable better use list syntax:

- type: log
  - 'TRANSIENT_ConnectFailed'  #  no need for .*
  - '<pattern2>'
  - '<pattern3>'

Is it possible to use the list syntax with more than one pattern per line?

It is working with the list syntax! Thanks!

Unfortunately not. If two patterns are very similar one can use an or expression like: - '(regex1)|(regex2)' or - '^common start ((regex1)|(regex2)) more common pattern'.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.