# Exclude Zabbix entry from being indexed

**URL:** <https://discuss.elastic.co/t/exclude-zabbix-entry-from-being-indexed/125614>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 26, 2018, 1:28pm UTC](https://discuss.elastic.co/t/exclude-zabbix-entry-from-being-indexed/125614 "2018-03-26T13:28:38Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Norman\_Khine](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/norman_khine/32/3342_2.png) [@Norman\_Khine](https://discuss.elastic.co/u/Norman_Khine)\
**Post date:** [March 26, 2018, 1:28pm UTC](https://discuss.elastic.co/t/exclude-zabbix-entry-from-being-indexed/125614/1 "2018-03-26T13:28:38Z")

</div>

Hello,  
Here is the prospector section of my filebeat.yml file

```
#=========================== Filebeat prospectors =============================

filebeat.prospectors:

    - type: log
      paths:
        - /var/log/*/*.log

      # Exclude lines. A list of regular expressions to match. It drops the lines that are
      # matching any regular expression from the list.
      exclude_lines: ['Zabbix']

```

I tried to exclude any Zabbix requests from being indexed, but this does not seem to be working as I still see these entries on ES.

```
@timestamp:March 26th 2018, 14:24:13.844 source:/var/log/nginx/access.log tags: web-app prospector.type:log fields.env:prod beat.name:ip-10-1-1-90 beat.hostname:ip-10-1-1-90 beat.version:6.2.3 offset:17,769,793 message:52.56.187.196 - - [26/Mar/2018:13:24:13 +0000] "GET / HTTP/1.1" 200 147136 "-" "Zabbix" _id:tg17YmIBmb9kTiSKDyl8 _type:doc _index:filebeat-6.2.3-2018.03.26 _score: -

```

What is the correct way to exclude these entries from being indexed?

Any advice is much appreciated

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 23, 2018, 9:42pm UTC](https://discuss.elastic.co/t/exclude-zabbix-entry-from-being-indexed/125614/3 "2018-04-23T21:42:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.