Exclude_lines and escape character *

Elastic Stack Beats
1

Hello,

I am new to ELK and I am learning as we speak, but I have an issue that I am not able to solve, so I am here requesting your help.

I have an index where several log files stream. One of them writes the next three lines every minute :

***************
Tue Jul 9 08:35:48 UTC 2024
Healthcheck passed, supressing output

I am trying to exclude these lines, but I can't make it work with the first one, it is received by Logstash:

[2024-07-08T18:20:37,014][ERROR][logstash.codecs.json ][intake][f979...c80] JSON parse error, original data now in message field {:message=>"Unexpected character ('' (code 42)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')\n at [Source: (String)"***********************"; line: 1, column: 2]", :exception=>LogStash::Json::ParserError, :data=>"**********************"}

But I can't see anything in Kibana. Not any other line from any log file. Everything is gone...

I have tried to use single and double quotes, escaping with "\" but nothing seems to work.

filebeat.inputs:
- type: filestream
  paths:
    - /home/Martull/log/*.log
  exclude_lines: ["^\*\*\*",'Healthcheck passed, supressing output']

Any ideas?

Thank you

2

I have been able to achieve it by including the symbol "\" twice and using double quotes:

exclude_lines: ["^\\*\\*",'Healthcheck passed, supressing output']

I am now trying to exclude the every minute line with the time stamp :slight_smile: