Filbeat exlude or include only

Hi All,

i have try to use filebat to ship syslog from Linux server, i use log type .

I want just to ship error content on /var/log/syslog and exlucde for exaample all line that content info .

My config client on filebeat


  • type: log
    enabled: true
    • /var/log/syslog
    • add_locale:
      format: abbreviation

exclude_lines: ['INFO']
include_lines: ['error']

But the filrebat still shippping all content /var/log/syslog

Thanks in advance for you help .


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.