Filebeat exclude lines that start with '+'

Elastic Stack Beats
1

Hi all... i'm trying to use Filebeat (v1.2.3) to exclude all log lines that start with a '+' (plus sign)...

I've tried;

  exclude_lines: ["^\+"]

I get the error;

Loading config file error: YAML config parsing failed on /etc/filebeat/filebeat.yml: yaml: line 36: found unknown escape character. Exiting.

Can someone help me figure out how to explain this to filebeat?

Thanks!

--
David

2

the config file format is yaml and yaml has some rules how strings are handled. 5 in total. Plus the \`` character is treated as escape character in yaml too. When writing regular expressions always use single quotes (like') instead of double quote (like"). This disables the yaml parser from interpreting`.

3

Awsome! Thanks for the help!

--
David

4

This topic was automatically closed after 21 days. New replies are no longer allowed.