# How can we use "filter" settings in logstash-input-journald plugin?

**URL:** <https://discuss.elastic.co/t/how-can-we-use-filter-settings-in-logstash-input-journald-plugin/217374>\
**Category:** Logstash\
**Created:** [January 31, 2020, 1:08pm UTC](https://discuss.elastic.co/t/how-can-we-use-filter-settings-in-logstash-input-journald-plugin/217374 "2020-01-31T13:08:42Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![talbehat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/talbehat/32/84367_2.png) [@talbehat](https://discuss.elastic.co/u/talbehat)\
**Post date:** [January 31, 2020, 1:08pm UTC](https://discuss.elastic.co/t/how-can-we-use-filter-settings-in-logstash-input-journald-plugin/217374/1 "2020-01-31T13:08:42Z")

</div>

Hi,

Please let me know in detail how to use filter keyword in logstash input configuration of logstash input jouranld plugin?

my aim to parse only some logs not all so how to do that.

use of this .....

# Filter on events. Not heavily tested.

```
#
config :filter, :validate => :hash, :required => false, :default => {}

```

thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 31, 2020, 3:27pm UTC](https://discuss.elastic.co/t/how-can-we-use-filter-settings-in-logstash-input-journald-plugin/217374/2 "2020-01-31T15:27:42Z")

</div>

The filter hash is just passed to the filter function of the journal object, so I would check the [documentation](https://www.rubydoc.info/gems/systemd-journal/Systemd%2FJournal%2FFilterable%3Afilter) for that.

Note that the journald input is a proof-of-concept, not a fully supported plugin.

---

<div class="post-metadata">

**Author:** ![talbehat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/talbehat/32/84367_2.png) [@talbehat](https://discuss.elastic.co/u/talbehat)\
**Post date:** [February 3, 2020, 6:39am UTC](https://discuss.elastic.co/t/how-can-we-use-filter-settings-in-logstash-input-journald-plugin/217374/3 "2020-02-03T06:39:20Z")

</div>

Thanks Badger,

# i am new in logstash, Can you please explain it in detail with example.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 3, 2020, 12:51pm UTC](https://discuss.elastic.co/t/how-can-we-use-filter-settings-in-logstash-input-journald-plugin/217374/4 "2020-02-03T12:51:36Z")

</div>

The documentation I linked to includes an example.

---

<div class="post-metadata">

**Author:** ![talbehat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/talbehat/32/84367_2.png) [@talbehat](https://discuss.elastic.co/u/talbehat)\
**Post date:** [February 3, 2020, 1:14pm UTC](https://discuss.elastic.co/t/how-can-we-use-filter-settings-in-logstash-input-journald-plugin/217374/5 "2020-02-03T13:14:26Z")

</div>

Thanks Badger, yes documentation is needful

---

<div class="post-metadata">

**Author:** ![talbehat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/talbehat/32/84367_2.png) [@talbehat](https://discuss.elastic.co/u/talbehat)\
**Post date:** [February 4, 2020, 6:46am UTC](https://discuss.elastic.co/t/how-can-we-use-filter-settings-in-logstash-input-journald-plugin/217374/6 "2020-02-04T06:46:29Z")

</div>

Hi Badger,

i am using "filter =\> {syslog\_identifier =\> 'su'}" in input configuration, but it is not showing any affect to use filter setting with journald plugin.

please let me know the right way to use this.

i am using input as below mention

# 

input {  
journald {  
#filter =\> 'SYSLOG\_IDENTIFIER=su'  
lowercase =\> true  
seekto =\> "tail"  
thisboot =\> true  
type =\> "journald"  
tags =\> ["journald"]  
path =\> "/run/log/journal"  
sincedb\_path =\> "/tmp/.sincedb\_journal"  
#filter { SYSLOG\_IDENTIFIER =\> "su" }  
filter =\> {syslog\_identifier =\> 'su'}  
}  
}

my aim to filter only "\_comm" =\> 'su'.

---

<div class="post-metadata">

**Author:** ![talbehat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/talbehat/32/84367_2.png) [@talbehat](https://discuss.elastic.co/u/talbehat)\
**Post date:** [February 5, 2020, 10:12am UTC](https://discuss.elastic.co/t/how-can-we-use-filter-settings-in-logstash-input-journald-plugin/217374/7 "2020-02-05T10:12:07Z")

</div>

Badger, can you explain above query.

---

<div class="post-metadata">

**Author:** ![fastlearner](https://avatars.discourse-cdn.com/v4/letter/f/d9b06d/32.png) [@fastlearner](https://discuss.elastic.co/u/fastlearner)\
**Post date:** [February 10, 2020, 7:40am UTC](https://discuss.elastic.co/t/how-can-we-use-filter-settings-in-logstash-input-journald-plugin/217374/8 "2020-02-10T07:40:46Z")

</div>

Hi Badger,  
please do reply i am also interested to know the answer.  
please suggest one example to use filter in input journald plugin.

---

<div class="post-metadata">

**Author:** ![talbehat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/talbehat/32/84367_2.png) [@talbehat](https://discuss.elastic.co/u/talbehat)\
**Post date:** [February 12, 2020, 6:28am UTC](https://discuss.elastic.co/t/how-can-we-use-filter-settings-in-logstash-input-journald-plugin/217374/9 "2020-02-12T06:28:51Z")

</div>

Hi Badger,

# Can you please help us to know this input configuration to use filter in journald plugin

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 11, 2020, 6:28am UTC](https://discuss.elastic.co/t/how-can-we-use-filter-settings-in-logstash-input-journald-plugin/217374/10 "2020-03-11T06:28:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.