Filebeat Exclude_lines config not working


I'm trying to ignore some log lines using Filebeat:

exclude_lines: ['StateManagerComponent[[:space:]]ERROR - ProcessConfirmBlock - Unknown blockUid']

This is supposed to match and exclude this specific log line event:

NetState	51497	2018/12/13 14:57:30.180	StateManagerComponent	ERROR - ProcessConfirmBlock - Unknown blockUid

But this is not working as I can always see this event on Kibana. Can anyone help me??


I think your config is looking for exact match, can you try the below format.It should work.replace the message with your string

exclude_lines: ['.*?(message).*']

I tried but the event was still being shipped to kibana.

exclude_lines: ['.*?(StateManagerComponent[[:space:]]ERROR - ProcessConfirmBlock - Unknown blockUid).*']

@miguel, Can you please try below pattern:

exclude_lines:  ['^.*StateManagerComponent	ERROR - ProcessConfirmBlock - Unknown blockUid.*$']


Can you please share your complete config?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.