# Filebeat drop events with multiple words

**URL:** <https://discuss.elastic.co/t/filebeat-drop-events-with-multiple-words/116768>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 23, 2018, 10:58pm UTC](https://discuss.elastic.co/t/filebeat-drop-events-with-multiple-words/116768 "2018-01-23T22:58:03Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![thinkdffrnt](https://avatars.discourse-cdn.com/v4/letter/t/82dd89/32.png) [@thinkdffrnt](https://discuss.elastic.co/u/thinkdffrnt)\
**Post date:** [January 23, 2018, 10:58pm UTC](https://discuss.elastic.co/t/filebeat-drop-events-with-multiple-words/116768/1 "2018-01-23T22:58:03Z")

</div>

I'm trying to drop events with multiple words like

> Tuple, TUPLE, tuple

Complete config doesn't seem to work with one word filter too

```
filebeat:
  registry_file: /var/run/filebeat/.gl-filebeat-registry
  spool_size: 2048
  prospectors:
    -
      paths:
        - /opt/cargovan/storm/apache-storm-1.0.2/logs/workers-artifacts/*/*/worker.log
      input_type: log
      ignore_older: 10m
      close_older: 5m
      max_bytes: 2097152
      fields:
        OO_CLOUD: test-cloud
      fields_under_root: false
      tail_files: false
  processors:
  - drop_event:
      when:
        regexp:
           message: 'TUPLE'
output:
  logstash:
    hosts: ['test-url:5044']
    loadbalance: true
    worker: 2
    max_retries: -1
    bulk_max_size: 2048
logging:
  level: warning
  to_files: false
  to_syslog: true

```

Also tried using with multiple words like below

```
  processors:
  - drop_event:
      when:
        regexp:
           message: 'TUPLE'
           message: 'Tuple'

```

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [January 24, 2018, 9:27am UTC](https://discuss.elastic.co/t/filebeat-drop-events-with-multiple-words/116768/2 "2018-01-24T09:27:25Z")

</div>

You can set a single regexp to match multiple words, like this:

```auto
- drop_event:
    when:
      regexp:
        message: 'Tuple|TUPLE|tuple'

```

However, if what you want is to drop regardless of case, then I suggest prefixing the regexp with (?i), as in:

```auto
message: '(?i)tuple'

```

Have a look at:

[https://www.elastic.co/guide/en/beats/filebeat/5.5/regexp-support.html](https://www.elastic.co/guide/en/beats/filebeat/5.5/regexp-support.html)

---

<div class="post-metadata">

**Author:** ![thinkdffrnt](https://avatars.discourse-cdn.com/v4/letter/t/82dd89/32.png) [@thinkdffrnt](https://discuss.elastic.co/u/thinkdffrnt)\
**Post date:** [January 24, 2018, 7:44pm UTC](https://discuss.elastic.co/t/filebeat-drop-events-with-multiple-words/116768/3 "2018-01-24T19:44:05Z")

</div>

> [@adrisr](#):
>
> 'Tuple|TUPLE|tuple'

Thank you @adrisr I'm using Filebeat version 5.0 and above doesn't seem to filter any messages with tuple String  
Sample which is still flowing

message

`2018-01-24 19:42:01.994 o.a.s.d.executor [INFO] Processing received message FOR -2 TUPLE: source: __system:-1, stream:__ metrics_tick, id: {}, [60]`

---

<div class="post-metadata">

**Author:** ![thinkdffrnt](https://avatars.discourse-cdn.com/v4/letter/t/82dd89/32.png) [@thinkdffrnt](https://discuss.elastic.co/u/thinkdffrnt)\
**Post date:** [January 25, 2018, 12:26am UTC](https://discuss.elastic.co/t/filebeat-drop-events-with-multiple-words/116768/4 "2018-01-25T00:26:53Z")

</div>

Interestingly the below solution worked

```
  prospectors: 
    - 
      close_older: 5m
      exclude_lines: 
        - Tuple
        - TUPLE
        - tuple
```

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [January 25, 2018, 9:47am UTC](https://discuss.elastic.co/t/filebeat-drop-events-with-multiple-words/116768/5 "2018-01-25T09:47:34Z")

</div>

Glad you found a solution!

---

<div class="post-metadata">

**Author:** ![thinkdffrnt](https://avatars.discourse-cdn.com/v4/letter/t/82dd89/32.png) [@thinkdffrnt](https://discuss.elastic.co/u/thinkdffrnt)\
**Post date:** [January 26, 2018, 4:57am UTC](https://discuss.elastic.co/t/filebeat-drop-events-with-multiple-words/116768/6 "2018-01-26T04:57:36Z")

</div>

Thank you for your help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 23, 2018, 4:58am UTC](https://discuss.elastic.co/t/filebeat-drop-events-with-multiple-words/116768/7 "2018-02-23T04:58:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.