I am using the filebeat nginx module and want to exclude certain lines. Therefore I want to add a
drop_event processor to the module configuration. This fails with following error message:
filebeat.modules: - module: nginx access: enabled: true var.paths: - "/var/log/nginx/*.access.log*" input: processors: - drop_event: when.regexp.message: "/status" error: enabled: true var.paths: - "/var/log/nginx/*.error.log*"
Here is the relevant section of my
Exiting: Error while initializing input: each processor must have exactly one action, but found 2 actions (drop_event,add_locale)
Reading through the source of the filebeat module, it seems the add_locale event is added by the module. Any way to resolve this, or should I add the processor on a higher level?