# Filtering specific range of lines from log using Filebeat

**URL:** <https://discuss.elastic.co/t/filtering-specific-range-of-lines-from-log-using-filebeat/172894>\
**Category:** Elasticsearch\
**Created:** [March 19, 2019, 4:45am UTC](https://discuss.elastic.co/t/filtering-specific-range-of-lines-from-log-using-filebeat/172894 "2019-03-19T04:45:58Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![avj1986](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/avj1986/32/42478_2.png) [@avj1986](https://discuss.elastic.co/u/avj1986)\
**Post date:** [March 19, 2019, 4:45am UTC](https://discuss.elastic.co/t/filtering-specific-range-of-lines-from-log-using-filebeat/172894/1 "2019-03-19T04:45:58Z")

</div>

Hello,

I am working on setting up ELK stack. My use case suggests to filter specific lines from logs using filebeat and send them to Logstash with custom fields appended.  
E.g.

Sample Log file:

> ```
> Log process started
> Scan started with ID 1 and MID 1
> Processing this event
> Event prod started
> Processing time is 1.2 seconds
> Scan Completed
> Dumping metadata to logs
> Metadata dump finished
> Processing threads stopped
> 
> ```

I need to filter the lines from "Scan started with ID 1 and MID 1" to "Scan Completed" (In this log file, 2nd line to 4th last line)  
I am expecting the filtered lines should be sent to logstash with ID and MID from logs to be prepended.  
E.g.

```
Scan started with ID 1 and MID 1
ID:1 MID:1 Processing this event
ID:1 MID:1 Event prod started
ID:1 MID:1 Processing time is 1.2 seconds
Scan Completed

```

I was thinking of using processors like include\_fields [when: contains: has\_fields: "Scan Started"].  
Since, I am new to ELK, I am not very sure how to achieve filtering of specific range of lines.  
Can someone please guide me.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 16, 2019, 4:45am UTC](https://discuss.elastic.co/t/filtering-specific-range-of-lines-from-log-using-filebeat/172894/2 "2019-04-16T04:45:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.