# Exclude\_lines per file

**URL:** https://discuss.elastic.co/t/exclude-lines-per-file/152129
**Category:** Beats
**Tags:** filebeat
**Created:** [October 11, 2018, 9:31pm UTC](https://discuss.elastic.co/t/exclude-lines-per-file/152129 "2018-10-11T21:31:40Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Bkt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bkt/32/48260_2.png) [@Bkt](https://discuss.elastic.co/u/Bkt)
#### Post date: [October 11, 2018, 9:31pm UTC](https://discuss.elastic.co/t/exclude-lines-per-file/152129/1 "2018-10-11T21:31:40Z")

</div>

Hello,  
I have a filebeat which has 2 files, I would like to have exclude lines different for each one, is it possible to add exclude\_lines per path?  
the potential config is as below i.e. for access.log I want to exclude different lines while allowing the same lines to go through from the weblogic.log  
Thanks for taking the time to read this,

```
filebeat.inputs:
- type: log
enabled: true
paths:
  - /scratch/tmp/elk_docker/access.log
    exclude_lines:['\/health(\/[a-z]*)*\t200', '(?:.*registry)(?:.*\t200)']
 - /scratch/tmp/elk_docker/weblogic.log
   exclude_lines:['BEA-000628', 'BEA-001128', '\/authorization\/rest\/[v0-9\.]+\/auth\/query\t200']
```

---

<div class="post-metadata">

### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [October 15, 2018, 10:41pm UTC](https://discuss.elastic.co/t/exclude-lines-per-file/152129/2 "2018-10-15T22:41:25Z")

</div>

No, that is not possible. This is not even valid YAML. But you can configure 2 inputs instead of 2 paths:

```auto
filebeat.inputs:
- type: log
  paths: [/scratch/tmp/elk_docker/access.log]
  exclude_lines: ['\/health(\/[a-z]*)*\t200', '(?:.*registry)(?:.*\t200)']
- type: log
  paths: [/scratch/tmp/elk_docker/weblogic.log]
  exclude_lines: ['BEA-000628', 'BEA-001128', '\/authorization\/rest\/[v0-9\.]+\/auth\/query\t200']

```

As you use docker, this looks like a good use-case for docker auto-discovery.

---

<div class="post-metadata">

### Author: ![Bkt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bkt/32/48260_2.png) [@Bkt](https://discuss.elastic.co/u/Bkt)
#### Post date: [October 17, 2018, 4:26pm UTC](https://discuss.elastic.co/t/exclude-lines-per-file/152129/3 "2018-10-17T16:26:54Z")

</div>

Thanks Steffen, yes it's an invalid yaml, was just checking if something like it was possible. I was trying to avoid different file beat processes. Seems that's the route I will have to take.

---

<div class="post-metadata">

### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [October 18, 2018, 8:55pm UTC](https://discuss.elastic.co/t/exclude-lines-per-file/152129/4 "2018-10-18T20:55:24Z")

</div>

Why you need 2 filebeat processes? My sample configuration shows how it can be done within one filebeat process, just with 2 input configurations.

---

<div class="post-metadata">

### Author: ![Bkt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bkt/32/48260_2.png) [@Bkt](https://discuss.elastic.co/u/Bkt)
#### Post date: [November 5, 2018, 4:41pm UTC](https://discuss.elastic.co/t/exclude-lines-per-file/152129/5 "2018-11-05T16:41:45Z")

</div>

Thanks! I misread the previous answer. This works as expected

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 3, 2018, 4:41pm UTC](https://discuss.elastic.co/t/exclude-lines-per-file/152129/6 "2018-12-03T16:41:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
