# Filter logs

**URL:** <https://discuss.elastic.co/t/filter-logs/129296>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 24, 2018, 11:25am UTC](https://discuss.elastic.co/t/filter-logs/129296 "2018-04-24T11:25:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gangireddy\_l](https://avatars.discourse-cdn.com/v4/letter/g/c89c15/32.png) [@gangireddy\_l](https://discuss.elastic.co/u/gangireddy_l)\
**Post date:** [April 24, 2018, 11:25am UTC](https://discuss.elastic.co/t/filter-logs/129296/1 "2018-04-24T11:25:21Z")

</div>

HI,

Iam using filebeat as logshipper with Elk , example of my logs are shown below how to filter logs so that i need to receive only logs which contains REQUEST XML.

![image](https://us1.discourse-cdn.com/elastic/original/3X/8/9/895aba639d3f16e4baa4ecf8ef890a41fd9e8168.png)

Thanks  
GR.

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [April 24, 2018, 2:08pm UTC](https://discuss.elastic.co/t/filter-logs/129296/2 "2018-04-24T14:08:07Z")

</div>

You want to use the include\_lines directive in filebeat prospector:

```auto
filebeat.prospectors:
- paths:
    - /var/log/myapp/*.log
  include_lines: 'Request XML :'

```

See [https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html#include-lines](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html#include-lines)

---

<div class="post-metadata">

**Author:** ![gangireddy\_l](https://avatars.discourse-cdn.com/v4/letter/g/c89c15/32.png) [@gangireddy\_l](https://discuss.elastic.co/u/gangireddy_l)\
**Post date:** [April 25, 2018, 3:39am UTC](https://discuss.elastic.co/t/filter-logs/129296/3 "2018-04-25T03:39:52Z")

</div>

Thanks Adrian for your reply.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 23, 2018, 3:39am UTC](https://discuss.elastic.co/t/filter-logs/129296/4 "2018-05-23T03:39:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.