Exclude path at .conf file

[manosmustang (manos)]

Hello,

I have the below netdata.conf file and i want to exclude the path /var/log/messages

[root@centos conf.d]# cat  netdata.conf
input {
    beats {
        port => 5044
     }
    } 
output {
 elasticsearch {
    hosts => ["localhost:9200"]
    index => "netdatalogs"
  }
stdout { codec => rubydebug }
}

Any ideas?

Thank you

[BennyInc (Benny)]

So you get data from a beat (filebeat?) but don't want to push the events to elasticsearch/stdout if the path is /var/logs/messages? I would assume your beat should store the path in a field, e.g. "source". You can then use conditionals to only use the outputs if that path is not given:

output {
  if [source] != "/var/logs/messages" {
    elasticsearch {
      hosts => ["localhost:9200"]
      index => "netdatalogs"
    }
    stdout { codec => rubydebug }
  }
}

[BKG]

you would need something like

filter {
    if [log][file][path] == "/var/log/messages" { drop{} }
}

[manosmustang (manos)]

and what if I want to add another if?

filter {
if [log][file][path] == "/var/log/messages" { drop{} }
if [log][file][path] == "/var/log/secure" { drop{} }
}

is this correct?

thank you

[manosmustang (manos)]

thanks BKG it worked!