Filebeat exclude_linex regex to exclude all lines not containing error

Elastic Stack Beats
1

Anyone can help me with the regex to ignore all lines that doesnt contain error or Error at any position of the line?

2

In the latest version of Filebeat there are two options to solve this issue:

  • using processors
processors:
  or:
    - when.contains.message: "Error"
    - when.contains.message: "error"
  • using exclude
exclude_lines: ["*error*", "*Error*"]
3

correcting the regexes here:

exclude_lines: ['.*error.*', '.*Error.*']

Btw. regex matching searches for sub-string matching the regular expression. That is, this config should perform much better:

exclude_lines: ['[eE]rror']

Tip: do not use double quotes " for regexes.

4

but that would exclude all lines containing eError. how do i negate it? I just want to send lines with error messages.

5

for log lines only having content [eE]rror, use the include_lines setting. When using processors, a not filter negating a predicate also exists.

6

Thanks!

7

This topic was automatically closed after 21 days. New replies are no longer allowed.