Hello, How can I allow only specific lines and for specific log files as well? example: I have lots of files in the inputs.d file but for the xyz.log file, I wanna set up the filter only to allow "out of memory" line other events will drop for only xyz.log file

something like this should work - type: log enabled: True paths: - /var/log/xvy.log exclude_files: ['[a-z A-Z]+-[0-9]{4}-[0-9]{2}-[0-9]{2}.json'] fields: log_type: kernel-log processors: - drop_event: when: not: contains: message…

Discuss the Elastic Stack

Filebeat allow only specific line or content

Elastic Stack Beats

abhi.logs (Abhi) May 18, 2022, 6:05am 3

Hello @Andrea_Spacca

No I have 4-5 config files inside inputs.d and I just wanna apply to xyz.log file only.

Topic		Replies	Views
Can filebeat pick up log entries based on keywords? Beats filebeat	3	352	August 23, 2019
How to drop multiple message names using filebeat Beats filebeat	10	3808	February 21, 2019
Exclude_lines per file Beats filebeat	5	609	December 3, 2018
How can I match on all log files except ones containing a string Beats filebeat	3	689	November 15, 2021
Filebeat filter message for specific path Beats filebeat	2	1122	February 15, 2018

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Filebeat allow only specific line or content

Related topics