Filebeat exclude_linex regex to exclude all lines not containing error

[agonzalez (Alberto)]

Anyone can help me with the regex to ignore all lines that doesnt contain error or Error at any position of the line?

[monica (Monica Sarbu)]

In the latest version of Filebeat there are two options to solve this issue:

• using processors

processors:
  or:
    - when.contains.message: "Error"
    - when.contains.message: "error"

• using exclude

exclude_lines: ["*error*", "*Error*"]

[steffens (Steffen Siering)]

correcting the regexes here:

exclude_lines: ['.*error.*', '.*Error.*']

Btw. regex matching searches for sub-string matching the regular expression. That is, this config should perform much better:

exclude_lines: ['[eE]rror']

Tip: do not use double quotes " for regexes.

[agonzalez (Alberto)]

@steffens

exclude_lines: ['[eE]rror']

but that would exclude all lines containing eError. how do i negate it? I just want to send lines with error messages.

[steffens (Steffen Siering)]

for log lines only having content [eE]rror, use the include_lines setting. When using processors, a not filter negating a predicate also exists.

[agonzalez (Alberto)]

Thanks!