# Filebeat exclude\_lines is not working on Openshift

**URL:** <https://discuss.elastic.co/t/filebeat-exclude-lines-is-not-working-on-openshift/271407>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 27, 2021, 3:44pm UTC](https://discuss.elastic.co/t/filebeat-exclude-lines-is-not-working-on-openshift/271407 "2021-04-27T15:44:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ferdous\_Khan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ferdous_khan/32/49396_2.png) [@Ferdous\_Khan](https://discuss.elastic.co/u/Ferdous_Khan)\
**Post date:** [April 27, 2021, 3:44pm UTC](https://discuss.elastic.co/t/filebeat-exclude-lines-is-not-working-on-openshift/271407/1 "2021-04-27T15:44:34Z")

</div>

Hello,

We have this Filebeat (v7.1) configuration on OpenShift Pod that only excludes lines that have 'ACPI' in it:

```auto
    - type: log
      paths:
        - /var/log/kern.log
      enabled: true
      exclude_lines: ['ACPI','ll header','martian source','promiscuous mode','SELinux: mount invalid']
      fields_under_root: true
      processors:
        - drop_event:
            when:
              or:
                - regexp: 
                    message: 'sd[a-z]..sd'

```

However, when I try similar configuration for Filebeat 7.11 on my PC, it works for all other keywords:

```auto
    filebeat.inputs:

    - type: log

      # Change to true to enable this input configuration.
      enabled: true

      # Paths that should be crawled and fetched. Glob based paths.
      paths:
        - /mnt/d/Temp/kern.log

      #exclude_lines: ['^DBG']
      exclude_lines: ['ACPI','ll header','martian source','promiscuous mode','SELinux: mount invalid']

```

Any idea why?

Sample log:

Apr 2 03:33:09 ocphost-1 kernel: [2076465.390809] IPv4: martian source 10.200.20011 from  
Apr 2 03:33:09 ocphost-1 kernel: [1076365.390817] ll header: 00000000: 11 50 56 ad 98 d4 d8 67  
Apr 2 03:40:10 ocphost-1 kernel: [5897106.058647] ACPI Error: Method parse/execution failed  
Apr 2 08:07:58 ocphost-1 kernel: [5908172.576414] sdc: sdc1 sdc2

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [April 28, 2021, 8:37am UTC](https://discuss.elastic.co/t/filebeat-exclude-lines-is-not-working-on-openshift/271407/2 "2021-04-28T08:37:43Z")

</div>

Could you please share the debug logs of Filebeat? It tells you when and why a line was excluded.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 26, 2021, 10:37am UTC](https://discuss.elastic.co/t/filebeat-exclude-lines-is-not-working-on-openshift/271407/3 "2021-05-26T10:37:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.