# Exclude\_lines and escape character \*

**URL:** <https://discuss.elastic.co/t/exclude-lines-and-escape-character/362778>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 9, 2024, 8:45am UTC](https://discuss.elastic.co/t/exclude-lines-and-escape-character/362778 "2024-07-09T08:45:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Martull](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/martull/32/135905_2.png) [@Martull](https://discuss.elastic.co/u/Martull)\
**Post date:** [July 9, 2024, 8:45am UTC](https://discuss.elastic.co/t/exclude-lines-and-escape-character/362778/1 "2024-07-09T08:45:44Z")

</div>

Hello,

I am new to ELK and I am learning as we speak, but I have an issue that I am not able to solve, so I am here requesting your help.

I have an index where several log files stream. One of them writes the next three lines every minute :

\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
Tue Jul 9 08:35:48 UTC 2024  
Healthcheck passed, supressing output

I am trying to exclude these lines, but I can't make it work with the first one, it is received by Logstash:

[2024-07-08T18:20:37,014][ERROR][logstash.codecs.json][intake][f979...c80] JSON parse error, original data now in message field {:message=\>"Unexpected character ('_' (code 42)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')\n at [Source: (String)"\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*"; line: 1, column: 2]", :exception=\>LogStash::Json::ParserError, :data=\>"\*_\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*"}

But I can't see anything in Kibana. Not any other line from any log file. Everything is gone...

I have tried to use single and double quotes, escaping with "\" but nothing seems to work.

```auto
filebeat.inputs:
- type: filestream
  paths:
    - /home/Martull/log/*.log
  exclude_lines: ["^\*\*\*",'Healthcheck passed, supressing output']

```

Any ideas?

Thank you

---

<div class="post-metadata">

**Author:** ![Martull](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/martull/32/135905_2.png) [@Martull](https://discuss.elastic.co/u/Martull)\
**Post date:** [July 9, 2024, 6:01pm UTC](https://discuss.elastic.co/t/exclude-lines-and-escape-character/362778/2 "2024-07-09T18:01:07Z")

</div>

I have been able to achieve it by including the symbol "\" twice and using double quotes:

`exclude_lines: ["^\\*\\*",'Healthcheck passed, supressing output']`

I am now trying to exclude the every minute line with the time stamp 🙂