File output plugin of logstash to capture the drop events

[santhosh244 (santhosh)]

Below is the scenario:

We are dropping events in filter section if log_level are DEBUG and that is getting properly dropped and not sent to ES.

But we would like to capture those events in a flat file using file output plugin. But it is not working.

if ([log_level] == "INFO"){
drop {}
}

We have the file plugin in outfile file. Any suggestion on this requirement.

Version of Components:

elasticsearch-2.1.1,logstash-2.1.1, kibana-4.3.1-linux-x64, and filebeat-1.2.0-1.x86_64

[magnusbaeck (Magnus Bäck)]

Dropped events are dropped and don't reach any output. Instead of the drop filter, structure your outputs like this:

if [log_level] == "INFO" {
  file {
    ...
  }
} else {
  elasticsearch {
    ...
  }
}