# Filebeat: Match literal \* or \*\* in messages

**URL:** <https://discuss.elastic.co/t/filebeat-match-literal-or-in-messages/133757>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 29, 2018, 9:32pm UTC](https://discuss.elastic.co/t/filebeat-match-literal-or-in-messages/133757 "2018-05-29T21:32:28Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Krog](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krog/32/27255_2.png) [@Krog](https://discuss.elastic.co/u/Krog)\
**Post date:** [May 29, 2018, 9:32pm UTC](https://discuss.elastic.co/t/filebeat-match-literal-or-in-messages/133757/1 "2018-05-29T21:32:28Z")

</div>

I have log files that contain the following:

```
<15:00:51.504 DBG ...
<15:00:52.173 *WRN* SM ...
<15:00:52.173 **ERR** TSS ...
<15:00:52.173 TRC EWF ...

```

I would like to drop any messages that do not contain _WRN_ or **ERR** from filebeats, but I can't figure out how to format my regular expression to do that.

When I use this:

```
processors:
  - drop_event:
      when:
        not:
          regexp:
            message: " *WRN* | *\*ERR*\* "

```

I get an error about the unknown escape sequence. If I use single quotes:

```
processors:
  - drop_event:
      when:
        not:
          regexp:
            message: ' *WRN* | *\*ERR*\* '

```

I never get any output to logstash.

How can I match both \*WRN and **ERR** successfully?

Best Regards  
Ken

---

<div class="post-metadata">

**Author:** ![Debashis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/debashis/32/45290_2.png) [@Debashis](https://discuss.elastic.co/u/Debashis)\
**Post date:** [May 30, 2018, 11:34am UTC](https://discuss.elastic.co/t/filebeat-match-literal-or-in-messages/133757/2 "2018-05-30T11:34:33Z")

</div>

Hi @Krog,

As per my understanding, you want to drop any message that does not contain WRN or ERR.  
Hence it implies that you just want to send the WRN and ERR messages to logstash.

you can do it by configuring "include\_lines" option

> filebeat.prospectors:
> 
> - input\_type: log  
> **include\_lines: ["WRN", "ERR"]**

---

<div class="post-metadata">

**Author:** ![Krog](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krog/32/27255_2.png) [@Krog](https://discuss.elastic.co/u/Krog)\
**Post date:** [May 30, 2018, 11:56am UTC](https://discuss.elastic.co/t/filebeat-match-literal-or-in-messages/133757/3 "2018-05-30T11:56:25Z")

</div>

Great - Let me try that and hopefully it will work better than trying to use a processor section.

Ken

---

<div class="post-metadata">

**Author:** ![Debashis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/debashis/32/45290_2.png) [@Debashis](https://discuss.elastic.co/u/Debashis)\
**Post date:** [May 31, 2018, 8:10am UTC](https://discuss.elastic.co/t/filebeat-match-literal-or-in-messages/133757/4 "2018-05-31T08:10:29Z")

</div>

Hello @Krog,

If you want to escape \* then use \\* . I think it will help you more. 🙂

---

<div class="post-metadata">

**Author:** ![Krog](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krog/32/27255_2.png) [@Krog](https://discuss.elastic.co/u/Krog)\
**Post date:** [May 31, 2018, 4:22pm UTC](https://discuss.elastic.co/t/filebeat-match-literal-or-in-messages/133757/5 "2018-05-31T16:22:27Z")

</div>

That's what I ended up doing in the prospectors section:

```
- type: log
  paths:
    - /Images_Prod/Server1/logs/*
  exclude_files: ['\.gz$']
  include_lines: [' \*WRN\* ',' \*\*ERR\*\* ']

```

My original thought was to use a processor section but I couldn't figure out how to escape the asterisks and avoid the dreaded _unknown escape sequence_ error.

Your suggestion to use the include\_lines directive was a much better solution anyway.

Thank you for the assist.

Regards

Ken

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 28, 2018, 4:22pm UTC](https://discuss.elastic.co/t/filebeat-match-literal-or-in-messages/133757/6 "2018-06-28T16:22:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.