# Filebeat ignore log entries with certain size

**URL:** <https://discuss.elastic.co/t/filebeat-ignore-log-entries-with-certain-size/241009>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 13, 2020, 4:04pm UTC](https://discuss.elastic.co/t/filebeat-ignore-log-entries-with-certain-size/241009 "2020-07-13T16:04:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sfenman](https://avatars.discourse-cdn.com/v4/letter/s/f04885/32.png) [@sfenman](https://discuss.elastic.co/u/sfenman)\
**Post date:** [July 13, 2020, 4:04pm UTC](https://discuss.elastic.co/t/filebeat-ignore-log-entries-with-certain-size/241009/1 "2020-07-13T16:04:41Z")

</div>

Hello,

I am using filebeat to parse logs from my server directly to Elastic cloud. Sometimes there are some inconsistent logs entries with hundreds of log lines which I don't want to harvest them. Is there any way I can achieve this? Also is it possible that those logs are responsible for high memory pressure of my cluster?

Thanks

---

<div class="post-metadata">

**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\
**Post date:** [July 14, 2020, 7:39am UTC](https://discuss.elastic.co/t/filebeat-ignore-log-entries-with-certain-size/241009/2 "2020-07-14T07:39:47Z")

</div>

Hi!

You can use a processor like [https://www.elastic.co/guide/en/beats/filebeat/current/drop-event.html](https://www.elastic.co/guide/en/beats/filebeat/current/drop-event.html) to drop the events you don't want to ship to ES.

About memory pressure, it could be anything however dropping this kind of unwanted events may improve things since it will reduce the amount of data ES has to index.

C.

---

<div class="post-metadata">

**Author:** ![sfenman](https://avatars.discourse-cdn.com/v4/letter/s/f04885/32.png) [@sfenman](https://discuss.elastic.co/u/sfenman)\
**Post date:** [July 14, 2020, 11:45am UTC](https://discuss.elastic.co/t/filebeat-ignore-log-entries-with-certain-size/241009/3 "2020-07-14T11:45:08Z")

</div>

Thanks for your response Chris.

Since there is no specific pattern to use a conditional to drop logs, I have used truncate field proccessor [https://www.elastic.co/guide/en/beats/filebeat/current/truncate-fields.html](https://www.elastic.co/guide/en/beats/filebeat/current/truncate-fields.html) to set a maximum characters limit.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 11, 2020, 2:00pm UTC](https://discuss.elastic.co/t/filebeat-ignore-log-entries-with-certain-size/241009/4 "2020-08-11T14:00:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.