Filebeat negate regexp

Elastic Stack Beats
1

Hello

How can I negate this

  processors:
  - drop_event:
      when:
        regexp:
          message: "^[0-9]"

I want to read only lines beginning with a number and ignore all others.

Thank you
Marcus

2

I think u can do when.not....

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.