# Filter specific Message with logstash before sending to ElasticSearch

**URL:** <https://discuss.elastic.co/t/filter-specific-message-with-logstash-before-sending-to-elasticsearch/28584>\
**Category:** Logstash\
**Created:** [September 3, 2015, 8:02am UTC](https://discuss.elastic.co/t/filter-specific-message-with-logstash-before-sending-to-elasticsearch/28584 "2015-09-03T08:02:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hayder\_Abbass](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hayder_abbass/32/4559_2.png) [@Hayder\_Abbass](https://discuss.elastic.co/u/Hayder_Abbass)\
**Post date:** [September 3, 2015, 8:02am UTC](https://discuss.elastic.co/t/filter-specific-message-with-logstash-before-sending-to-elasticsearch/28584/1 "2015-09-03T08:02:13Z")

</div>

Hello,

I had like to know if it is possible to send only specific log messages to elasticsearch via logstash? E.G let's say I have these messages in my log file:

2015-08-14 12:21:03 [31946] PASS level2 10.249.10.70 level2 [http://google.com](http://google.com)  
2015-08-14 12:25:00 [2492] domainlist "/etc/ufdbguard/blacklists/filehosting/domains  
2015-08-14 12:21:03 [31946] PASS level2 10.249.10.41 level2 [http://yahoo.com](http://yahoo.com)

I had like to skip the second line when logstash/log forwarder process this log, is it possible to instruct it to skip any log message with the keyword ' **domainlist**'? Or allow only log messages with the keyword ' **PASS**'?

Thanks in advance for your help 😄

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 3, 2015, 8:37am UTC](https://discuss.elastic.co/t/filter-specific-message-with-logstash-before-sending-to-elasticsearch/28584/2 "2015-09-03T08:37:21Z")

</div>

Use a [conditional](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals):

```
output {
  if "PASS" in [message] {
    elasticsearch {
      ...
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![Hayder\_Abbass](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hayder_abbass/32/4559_2.png) [@Hayder\_Abbass](https://discuss.elastic.co/u/Hayder_Abbass)\
**Post date:** [September 4, 2015, 7:52am UTC](https://discuss.elastic.co/t/filter-specific-message-with-logstash-before-sending-to-elasticsearch/28584/3 "2015-09-04T07:52:02Z")

</div>

Thanks for your help 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:30am UTC](https://discuss.elastic.co/t/filter-specific-message-with-logstash-before-sending-to-elasticsearch/28584/4 "2017-07-06T05:30:07Z")

</div>