Hi warkolm,
thank you for the information! I have tried some things and came to the conclusion that i would like to handle it serverside. so i have got the configuration for that in one place. I have found a way via "drop" in the filter to drop the loglines. I just cant get it running. Could you have a look at the filter config what is wrong there?
filter {
if [input_type] == "iis" {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:log_timestamp} %{WORD:iisSite} %{IPORHOST:computername} %{IP:sourceip} %{WORD:csmethod} %{URIPATH:page} %{NOTSPACE:querystring} %{NUMBER:port} %{NOTSPACE:csusername} %{IP:cip} %{NOTSPACE:useragent} %{NOTSPACE:referer} %{NOTSPACE:cshost} %{NUMBER:scstatus} %{NUMBER:scsubstatus} %{NUMBER:scwin32status} %{NUMBER:scbytes} %{NUMBER:csbytes} %{NUMBER:timetaken}" }
}
if ([message] =~ "/health/") {
drop {}
}
}
}
when i run the configtest i get following error which i dont know how to handle:
root@stw-ch-log-01:/etc/logstash/conf.d# service logstash configtest
SyntaxError: (eval):162: halth
unknown regexp options - halth
eval at org/jruby/RubyKernel.java:1079
initialize at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.2-java/lib/logstash/pipeline.rb:57
execute at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.2-java/lib/logstash/agent.rb:172
run at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.2-java/lib/logstash/runner.rb:90
call at org/jruby/RubyProc.java:281
run at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.2-java/lib/logstash/runner.rb:95
call at org/jruby/RubyProc.java:281
initialize at /opt/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.22/lib/stud/task.rb:24