# Exclude\_lines in filebeat does not work? **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [December 19, 2022, 9:25am UTC](https://discuss.elastic.co/t/exclude-lines-in-filebeat-does-not-work/321535 "2022-12-19T09:25:30Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![ddoroshenko](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Post date:** [December 19, 2022, 9:25am UTC](https://discuss.elastic.co/t/exclude-lines-in-filebeat-does-not-work/321535/1 "2022-12-19T09:25:30Z")
Hi, I have log records like: ```auto 2022-12-12T07:07:07.007 *********************************** bla bla bla ``` To exclude these line I use `exclude_lines: ['^\n$','^\*+$']` in my filebeat configuration. But anyway I get empty lines and asterisk lines to ES. What's wrong? ---
**Author:** ![dadiasish](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadiasish/32/114221_2.png) [@dadiasish](https://discuss.elastic.co/u/dadiasish)\ **Post date:** [December 19, 2022, 10:22am UTC](https://discuss.elastic.co/t/exclude-lines-in-filebeat-does-not-work/321535/2 "2022-12-19T10:22:52Z")
I used to have data in below format. ```auto ============================================= # Timestamp : 2019-11-11T09:02:08.1591376Z # SourceId : 64f8a4d1-e1ec-5a27-52e2-5f6a013 # Level : Informational # serverName : PEPWAP12241 # systemId : 5962 # processorName : NACanadaIRSS_CI # methodName : ProcessFiles # userGpid : NACANADAIRSSProcessor # information : Document Type #3 was set to be processed. # Message : Information [System# 5,962 Processor 'NACanadaIRSS_CI' Method 'ProcessFiles'] :: UserGpid# NACANADAIRSSProcessor : Information - Document Type #3 was set to be processed. # Payload : [serverName : PEPWAP12241][systemId : 5962][processorName : NACanadaIRSS_CI][methodName : ProcessFiles][userGpid : NACANADAIRSSProcessor][information : Document Type #3 was set to be processed.] ============================================== ``` And my filebeat config looks in this way and it worked for me. ```auto #=========================== Filebeat inputs ============================= # Each - is an input. Most options can be set at the input level, so # you can use different inputs for various configurations. # Below are the input specific configurations. - type: log enabled: true exclude_lines: ['^=============================================='] fields: log_topics: nextgen-canada multiline.match: after multiline.negate: true multiline.pattern: "^#\\sTimestamp" paths: - "D:\\Logging Service\\IRSSNextGen-NA\\*.log" ``` ---
**Author:** ![ddoroshenko](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Post date:** [December 19, 2022, 10:38am UTC](https://discuss.elastic.co/t/exclude-lines-in-filebeat-does-not-work/321535/3 "2022-12-19T10:38:21Z")
I suppose, the problem is in multiline settings. Because multiline combine message into a single line before applying exclude\_lines filter ---
**Author:** ![dadiasish](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadiasish/32/114221_2.png) [@dadiasish](https://discuss.elastic.co/u/dadiasish)\ **Post date:** [December 19, 2022, 10:40am UTC](https://discuss.elastic.co/t/exclude-lines-in-filebeat-does-not-work/321535/4 "2022-12-19T10:40:33Z")
Yes. Try out in the way I've suggested and see if it works for you. ---
**Author:** ![ddoroshenko](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Post date:** [December 19, 2022, 10:51am UTC](https://discuss.elastic.co/t/exclude-lines-in-filebeat-does-not-work/321535/5 "2022-12-19T10:51:41Z")
It will exclude all lines containing that expression? ---
**Author:** ![dadiasish](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadiasish/32/114221_2.png) [@dadiasish](https://discuss.elastic.co/u/dadiasish)\ **Post date:** [December 19, 2022, 10:53am UTC](https://discuss.elastic.co/t/exclude-lines-in-filebeat-does-not-work/321535/6 "2022-12-19T10:53:54Z")
`exclude_lines: ['^==============================================']` The "^" symbol in the beginning says, starting with. So any line starting with the expression which I've given will be excluded from my file. ---
**Author:** ![ddoroshenko](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Post date:** [December 19, 2022, 10:57am UTC](https://discuss.elastic.co/t/exclude-lines-in-filebeat-does-not-work/321535/7 "2022-12-19T10:57:45Z")
Because you have another structure of the log. After applying multiline I have something like this ```auto 2022-12-12T07:07:07.007\n\n\n *********************************** \nbla bla bla ``` ---
**Author:** ![dadiasish](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadiasish/32/114221_2.png) [@dadiasish](https://discuss.elastic.co/u/dadiasish)\ **Post date:** [December 19, 2022, 11:03am UTC](https://discuss.elastic.co/t/exclude-lines-in-filebeat-does-not-work/321535/8 "2022-12-19T11:03:04Z")
Please share your log data of 2 - 3 lines and also send you filebeat config, so that I can look at it and can let you know ---
**Author:** ![ddoroshenko](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Post date:** [December 19, 2022, 11:22am UTC](https://discuss.elastic.co/t/exclude-lines-in-filebeat-does-not-work/321535/9 "2022-12-19T11:22:44Z")
All sufficient and necessary information is in my first post. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 16, 2023, 1:23pm UTC](https://discuss.elastic.co/t/exclude-lines-in-filebeat-does-not-work/321535/10 "2023-01-16T13:23:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.