Filebeat exclude_linex regex to exclude all lines not containing error

Anyone can help me with the regex to ignore all lines that doesnt contain error or Error at any position of the line?

In the latest version of Filebeat there are two options to solve this issue:

  • using processors
    - when.contains.message: "Error"
    - when.contains.message: "error"
  • using exclude
exclude_lines: ["*error*", "*Error*"]

correcting the regexes here:

exclude_lines: ['.*error.*', '.*Error.*']

Btw. regex matching searches for sub-string matching the regular expression. That is, this config should perform much better:

exclude_lines: ['[eE]rror']

Tip: do not use double quotes " for regexes.

but that would exclude all lines containing eError. how do i negate it? I just want to send lines with error messages.

for log lines only having content [eE]rror, use the include_lines setting. When using processors, a not filter negating a predicate also exists.


This topic was automatically closed after 21 days. New replies are no longer allowed.