# Excluding files from being indexed

**URL:** <https://discuss.elastic.co/t/excluding-files-from-being-indexed/39716>\
**Category:** Elasticsearch\
**Created:** [January 20, 2016, 11:36pm UTC](https://discuss.elastic.co/t/excluding-files-from-being-indexed/39716 "2016-01-20T23:36:40Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sashasec](https://avatars.discourse-cdn.com/v4/letter/s/47e85d/32.png) [@sashasec](https://discuss.elastic.co/u/sashasec)\
**Post date:** [January 20, 2016, 11:36pm UTC](https://discuss.elastic.co/t/excluding-files-from-being-indexed/39716/1 "2016-01-20T23:36:40Z")

</div>

To whom this may concern,

For my given use case, I collect syslogs which help identify unusual behavior on our systems. On occasion, however, our InfoSec team runs vulnerability scans (etc) and our ElasticSearch server get's overwhelmed by the massive amounts of logs generated. For this purpose I would like to exclude any logs to be indexed that contain a particular static IP.

Any ideas or suggestions are welcome.  
Respectfully,

Alex

---

<div class="post-metadata">

**Author:** ![sashasec](https://avatars.discourse-cdn.com/v4/letter/s/47e85d/32.png) [@sashasec](https://discuss.elastic.co/u/sashasec)\
**Post date:** [January 21, 2016, 12:48am UTC](https://discuss.elastic.co/t/excluding-files-from-being-indexed/39716/2 "2016-01-21T00:48:02Z")

</div>

Answered my own question:

It all depends on how logs are collected. In this case, I filtered for an expression much like this:  
if $msg contains "IP" then ~

[https://access.redhat.com/documentation/en-US/Red\_Hat\_Enterprise\_Linux/7/html/System\_Administrators\_Guide/s1-basic\_configuration\_of\_rsyslog.html](https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/s1-basic_configuration_of_rsyslog.html)

This question probably belongs in the Logstash category.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:22pm UTC](https://discuss.elastic.co/t/excluding-files-from-being-indexed/39716/3 "2017-07-05T23:22:51Z")

</div>