# Get some log in file but not all in filebeat

**URL:** <https://discuss.elastic.co/t/get-some-log-in-file-but-not-all-in-filebeat/319046>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 16, 2022, 9:35am UTC](https://discuss.elastic.co/t/get-some-log-in-file-but-not-all-in-filebeat/319046 "2022-11-16T09:35:11Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![devikingno](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/devikingno/32/105682_2.png) [@devikingno](https://discuss.elastic.co/u/devikingno)\
**Post date:** [November 16, 2022, 9:35am UTC](https://discuss.elastic.co/t/get-some-log-in-file-but-not-all-in-filebeat/319046/1 "2022-11-16T09:35:11Z")

</div>

Hello everyone, i have a problem to collect log from Filebeat to Logstash. The problem is that in the log file that I configure, I only want to get the log messages about the user's login and the other logs won't be fetched by Filebeat.  
For example: I have a sample log

```auto
1. 2022-11-15 11:12:06,872 15024 INFO user1 addons: Login success for user1 login:administrator from 127.0.0.1
2. 2022-11-15 11:12:06,872 15024 INFO user2 addons: Login failed for user2 login:administrator from 127.0.0.1
3. 2022-11-15 11:12:06,872 15024 Error user3 addons: Some error from server

```

Now, I only want Filebeat to get the log lines from user 1 and user 2 and don't want to log from user 3. Is there any way I can do this.  
Thanks everyone

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 14, 2022, 11:35am UTC](https://discuss.elastic.co/t/get-some-log-in-file-but-not-all-in-filebeat/319046/2 "2022-12-14T11:35:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.