Filebeat Exclude_lines config not working

Elastic Stack Beats
1

Hello,

I'm trying to ignore some log lines using Filebeat:

exclude_lines: ['StateManagerComponent[[:space:]]ERROR - ProcessConfirmBlock - Unknown blockUid']

This is supposed to match and exclude this specific log line event:

NetState	51497	2018/12/13 14:57:30.180	StateManagerComponent	ERROR - ProcessConfirmBlock - Unknown blockUid

But this is not working as I can always see this event on Kibana. Can anyone help me??

Thanks!!

2

I think your config is looking for exact match, can you try the below format.It should work.replace the message with your string

exclude_lines: ['.*?(message).*']

3

I tried but the event was still being shipped to kibana.

exclude_lines: ['.*?(StateManagerComponent[[:space:]]ERROR - ProcessConfirmBlock - Unknown blockUid).*']
4

@miguel, Can you please try below pattern:

exclude_lines:  ['^.*StateManagerComponent	ERROR - ProcessConfirmBlock - Unknown blockUid.*$']

Thanks.

5

Can you please share your complete config?

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.