I have log files that contain the following:
<15:00:51.504 DBG ... <15:00:52.173 *WRN* SM ... <15:00:52.173 **ERR** TSS ... <15:00:52.173 TRC EWF ...
I would like to drop any messages that do not contain WRN or ERR from filebeats, but I can't figure out how to format my regular expression to do that.
When I use this:
processors: - drop_event: when: not: regexp: message: " *WRN* | *\*ERR*\* "
I get an error about the unknown escape sequence. If I use single quotes:
processors: - drop_event: when: not: regexp: message: ' *WRN* | *\*ERR*\* '
I never get any output to logstash.
How can I match both *WRN and ERR successfully?