# Filter logs in logstash

**URL:** <https://discuss.elastic.co/t/filter-logs-in-logstash/26075>\
**Category:** Logstash\
**Created:** [July 22, 2015, 12:44pm UTC](https://discuss.elastic.co/t/filter-logs-in-logstash/26075 "2015-07-22T12:44:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Smasell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/smasell/32/43483_2.png) [@Smasell](https://discuss.elastic.co/u/Smasell)\
**Post date:** [July 22, 2015, 12:44pm UTC](https://discuss.elastic.co/t/filter-logs-in-logstash/26075/1 "2015-07-22T12:44:44Z")

</div>

Hi!!!  
I have several type logs that comes into logstash. And I don't need logs starts from CLIENT\_LOG with "event\_name": "CraftCard"  
I've create script in filter section:  
if [message] =~ /^CLIENT\_LOG / {  
if "event\_name: 'CraftCard" in [message]{  
noop {  
add\_tag =\> "removed\_log"  
}  
}  
}  
And then in output:  
if "removed\_log" in [tags]  
{  
}  
else  
{  
elasticsearch {  
host =\> "[myhost.com](http://myhost.com)"  
port =\> 9200  
index =\> "myindex"  
protocol =\> "http"  
}  
}  
Is this good solution or logstash provides solution better? Any ideas?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 22, 2015, 12:57pm UTC](https://discuss.elastic.co/t/filter-logs-in-logstash/26075/2 "2015-07-22T12:57:48Z")

</div>

It seems easier to just use the [drop filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-drop.html). You should also be able to detect the messages you want to drop using a single conditional. This should do:

```
filter {
  if [message] =~ /^CLIENT_LOG .*"event_name": "CraftCard"/ {
    drop { }
  }
}

```

(You're not being consistent about the single and double quotes in your example so you might need to adjust the regexp a bit.)

Is the log message in JSON format?

---

<div class="post-metadata">

**Author:** ![Smasell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/smasell/32/43483_2.png) [@Smasell](https://discuss.elastic.co/u/Smasell)\
**Post date:** [July 22, 2015, 1:03pm UTC](https://discuss.elastic.co/t/filter-logs-in-logstash/26075/3 "2015-07-22T13:03:07Z")

</div>

@magnusbaeck  
No, It's in format like this:  
"CLIENT\_LOG: User( ip: 84.202.219.93; user\_id: 694419; name: 'Sergey Flannon'; days\_in\_game: 2; pvp\_rating: 0; device\_model: 'samsung SM-N910F';). event\_name: 'CraftCard'; CraftLevel: 'Level4';"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:34am UTC](https://discuss.elastic.co/t/filter-logs-in-logstash/26075/4 "2017-07-06T05:34:02Z")

</div>