# Filter help

**URL:** <https://discuss.elastic.co/t/filter-help/55237>\
**Category:** Logstash\
**Created:** [July 11, 2016, 9:38pm UTC](https://discuss.elastic.co/t/filter-help/55237 "2016-07-11T21:38:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Diggy](https://avatars.discourse-cdn.com/v4/letter/d/e99b99/32.png) [@Diggy](https://discuss.elastic.co/u/Diggy)\
**Post date:** [July 11, 2016, 9:38pm UTC](https://discuss.elastic.co/t/filter-help/55237/1 "2016-07-11T21:38:25Z")

</div>

I've added the following filter to only capture Windows event types "WARNING" AND "ERROR":

if [type] == "eventlog" and "INFO" in [EventType] {  
drop {  
}  
}

Now, I'd like to exclude some hosts from this filter so that event types "INFO", "WARNING" AND "ERROR" are reported for them. I tried adding a regex, as follows:

if [Hostname !~ /^myhost? and [type] == "eventlog" and "INFO" in [EventType] or "INFO" in [Severity] {  
drop {  
}  
}

This doesn't work. The host "WARNING" and "ERROR" event types are still reported, but not "INFO" types. How do I achieve what I'm trying to?

Thanks.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 12, 2016, 5:55am UTC](https://discuss.elastic.co/t/filter-help/55237/2 "2016-07-12T05:55:40Z")

</div>

So the intended conditional becomes "drop the event unless it's is a warning or error unless the hostname is myhost"?

```nohighlight
if [EventType] not in ["WARNING", "ERROR] and [Hostname] not in ["myhost1", "myhost", ...] {
  drop { }
}

```

Or, if you prefer, the following conditional is equivalent:

```nohighlight
if !([EventType] in ["WARNING", "ERROR] or [Hostname] in ["myhost1", "myhost", ...]) {
  drop { }
}

```

---

<div class="post-metadata">

**Author:** ![Diggy](https://avatars.discourse-cdn.com/v4/letter/d/e99b99/32.png) [@Diggy](https://discuss.elastic.co/u/Diggy)\
**Post date:** [July 12, 2016, 1:50pm UTC](https://discuss.elastic.co/t/filter-help/55237/3 "2016-07-12T13:50:18Z")

</div>

> [@magnusbaeck](#):
>
> "drop the event unless it's is a warning or error unless the hostname is myhost"

Hi, and greetings, Magnus.

Yes, I'm after "drop the event unless it's is a warning or error unless the hostname is myhost". I'll try these. I really appreciate your help!

Diggy

---

<div class="post-metadata">

**Author:** ![Diggy](https://avatars.discourse-cdn.com/v4/letter/d/e99b99/32.png) [@Diggy](https://discuss.elastic.co/u/Diggy)\
**Post date:** [July 12, 2016, 6:40pm UTC](https://discuss.elastic.co/t/filter-help/55237/4 "2016-07-12T18:40:45Z")

</div>

Magnus,

I just wanted to report back that this filter seems to be working:

if !([EventType] in ["WARNING", "ERROR] or [Hostname] in ["myhost1", "myhost", ...]) {  
drop { }  
}

but this one doesn't:

if [EventType] not in ["WARNING", "ERROR] and [Hostname] not in ["myhost1", "myhost", ...] {  
drop { }  
}

Diggy

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:48am UTC](https://discuss.elastic.co/t/filter-help/55237/5 "2017-07-06T04:48:26Z")

</div>

Closed on July 6, 2017, 4:48am UTC