Exclude messages with Strings

Elastic Stack Beats
1

Hello,

I'm using Filebeat version 1.3 I want to ignore all LOG messages with Strings 'test' 'Test'
Does 1.3 support drop_event? If so, the below (sample)configuration doesn't work.

processors:

  • drop_event:
    when:
    regexp:
    message: 'Test'

Thank you in advance

2

There is a dash in front of drop_event which is automatically being edited. Please ignore.

3

I think drop_event was supported by Filebeat 1.3, that's a really old version, would you consider using a newer one? Latest stable is 6.1.0: https://www.elastic.co/downloads/beats/filebeat

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.