# Filebeat allow only specific line or content

**URL:** <https://discuss.elastic.co/t/filebeat-allow-only-specific-line-or-content/305017>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 18, 2022, 5:33am UTC](https://discuss.elastic.co/t/filebeat-allow-only-specific-line-or-content/305017 "2022-05-18T05:33:23Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![abhi.logs](https://avatars.discourse-cdn.com/v4/letter/a/d26b3c/32.png) [@abhi.logs](https://discuss.elastic.co/u/abhi.logs)\
**Post date:** [May 18, 2022, 5:33am UTC](https://discuss.elastic.co/t/filebeat-allow-only-specific-line-or-content/305017/1 "2022-05-18T05:33:24Z")

</div>

Hello,

How can I allow only specific lines and for specific log files as well?  
example: I have lots of files in the inputs.d file but for the xyz.log file, I wanna set up the filter only to allow "out of memory" line other events will drop for only xyz.log file

---

<div class="post-metadata">

**Author:** ![Andrea\_Spacca](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrea_spacca/32/76976_2.png) [@Andrea\_Spacca](https://discuss.elastic.co/u/Andrea_Spacca)\
**Post date:** [May 18, 2022, 6:01am UTC](https://discuss.elastic.co/t/filebeat-allow-only-specific-line-or-content/305017/2 "2022-05-18T06:01:21Z")

</div>

Hello @abhi.logs ,

do you have a single yaml config file that covers only `xyz.log` in `inputs.d`?

you could probably use the `drop_event` processor ([Drop events | Filebeat Reference [8.2] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/8.2/drop-event.html)) with a negative condition on `message` field containing "out of memory"

---

<div class="post-metadata">

**Author:** ![abhi.logs](https://avatars.discourse-cdn.com/v4/letter/a/d26b3c/32.png) [@abhi.logs](https://discuss.elastic.co/u/abhi.logs)\
**Post date:** [May 18, 2022, 6:05am UTC](https://discuss.elastic.co/t/filebeat-allow-only-specific-line-or-content/305017/3 "2022-05-18T06:05:42Z")

</div>

Hello @Andrea_Spacca

No I have 4-5 config files inside inputs.d and I just wanna apply to xyz.log file only.

---

<div class="post-metadata">

**Author:** ![Andrea\_Spacca](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrea_spacca/32/76976_2.png) [@Andrea\_Spacca](https://discuss.elastic.co/u/Andrea_Spacca)\
**Post date:** [May 18, 2022, 6:22am UTC](https://discuss.elastic.co/t/filebeat-allow-only-specific-line-or-content/305017/4 "2022-05-18T06:22:46Z")

</div>

hello @abhi.logs

which one is the input for xyz.log file?  
could you share the content?

---

<div class="post-metadata">

**Author:** ![abhi.logs](https://avatars.discourse-cdn.com/v4/letter/a/d26b3c/32.png) [@abhi.logs](https://discuss.elastic.co/u/abhi.logs)\
**Post date:** [May 18, 2022, 7:25am UTC](https://discuss.elastic.co/t/filebeat-allow-only-specific-line-or-content/305017/5 "2022-05-18T07:25:44Z")

</div>

helllo @Andrea_Spacca  
This is xyz.yml file inside inputs.d.like this I have 4-5 \*.yml file for different logs

```auto
- type: log

  enabled: True

  paths:
    - /var/log/xvy.log
  exclude_files: ['[a-z A-Z]+-[0-9]{4}-[0-9]{2}-[0-9]{2}.json']
  fields:  
    log_type: kernel-log

```

---

<div class="post-metadata">

**Author:** ![Andrea\_Spacca](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrea_spacca/32/76976_2.png) [@Andrea\_Spacca](https://discuss.elastic.co/u/Andrea_Spacca)\
**Post date:** [May 18, 2022, 7:47am UTC](https://discuss.elastic.co/t/filebeat-allow-only-specific-line-or-content/305017/6 "2022-05-18T07:47:23Z")

</div>

something like this should work

```auto
- type: log

  enabled: True

  paths:
    - /var/log/xvy.log
  exclude_files: ['[a-z A-Z]+-[0-9]{4}-[0-9]{2}-[0-9]{2}.json']
  fields:  
    log_type: kernel-log
  processors:
    - drop_event:
        when:
          not:
            contains:
              message: "out of memory"
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 15, 2022, 9:47am UTC](https://discuss.elastic.co/t/filebeat-allow-only-specific-line-or-content/305017/7 "2022-06-15T09:47:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.