Exclude log lines with nginx filebeat module

Elastic Stack Beats
1

I am using the filebeat nginx module and want to exclude certain lines. Therefore I want to add a drop_event processor to the module configuration. This fails with following error message:

filebeat.modules:
- module: nginx
  access:
    enabled: true
    var.paths:
    - "/var/log/nginx/*.access.log*"
    input:
      processors:
      - drop_event:
          when.regexp.message: "/status"
  error:
    enabled: true
    var.paths:
    - "/var/log/nginx/*.error.log*"

Here is the relevant section of my filebeat.yml configuration:

Exiting: Error while initializing input: each processor must have exactly one action, but found 2 actions (drop_event,add_locale)

Reading through the source of the filebeat module, it seems the add_locale event is added by the module. Any way to resolve this, or should I add the processor on a higher level?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.