Filebeat exclude_linex regex to exclude all lines not containing error


(Alberto Gonzalez) #1

Anyone can help me with the regex to ignore all lines that doesnt contain error or Error at any position of the line?


(Monica Sarbu) #2

In the latest version of Filebeat there are two options to solve this issue:

  • using processors
processors:
  or:
    - when.contains.message: "Error"
    - when.contains.message: "error"
  • using exclude
exclude_lines: ["*error*", "*Error*"]

(Steffen Siering) #3

correcting the regexes here:

exclude_lines: ['.*error.*', '.*Error.*']

Btw. regex matching searches for sub-string matching the regular expression. That is, this config should perform much better:

exclude_lines: ['[eE]rror']

Tip: do not use double quotes " for regexes.


(Alberto Gonzalez) #4

but that would exclude all lines containing eError. how do i negate it? I just want to send lines with error messages.


(Steffen Siering) #5

for log lines only having content [eE]rror, use the include_lines setting. When using processors, a not filter negating a predicate also exists.


(Alberto Gonzalez) #6

Thanks!


(system) #7

This topic was automatically closed after 21 days. New replies are no longer allowed.