Filebeat Exclude_lines config not working

Miguel_Leite · December 13, 2018, 3:03pm

Hello,

I'm trying to ignore some log lines using Filebeat:

exclude_lines: ['StateManagerComponent[[:space:]]ERROR - ProcessConfirmBlock - Unknown blockUid']

This is supposed to match and exclude this specific log line event:

NetState	51497	2018/12/13 14:57:30.180	StateManagerComponent	ERROR - ProcessConfirmBlock - Unknown blockUid

But this is not working as I can always see this event on Kibana. Can anyone help me??

Thanks!!

chandra0651 · December 13, 2018, 4:15pm

I think your config is looking for exact match, can you try the below format.It should work.replace the message with your string

exclude_lines: ['.*?(message).*']

Miguel_Leite · December 13, 2018, 4:29pm

I tried but the event was still being shipped to kibana.

exclude_lines: ['.*?(StateManagerComponent[[:space:]]ERROR - ProcessConfirmBlock - Unknown blockUid).*']

Tek_Chand · January 3, 2019, 12:18pm

@miguel, Can you please try below pattern:

exclude_lines:  ['^.*StateManagerComponent	ERROR - ProcessConfirmBlock - Unknown blockUid.*$']

Thanks.

steffens · January 3, 2019, 2:48pm

Can you please share your complete config?

system · January 31, 2019, 2:48pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.