How to create a logstash filter for index the logs with specific word only

[rijinmp (Rijin)]

I want to index only the logs contain the word "production" , anywhere in the log .

if the word " production" not present in log ... i dont want to index that line

[Badger]

@rijinmp

if the word " production" not present in log ... i dont want to index that line

if [message] !~ "production" { drop {} }

[rijinmp (Rijin)]

Thank you badger . It is working well . May i add one more word with this production .

Like Production or Deliver

I want to drop the lines those not contains Production or Deliver.

[Badger]

If you want to keep lines only if they contain both then

if [message] !~ "production" or [message] !~ "deliver" { drop {} }

If you want to keep lines that contain either then

if [message] =~ "production" or [message] =~ "deliver" {} else { drop {} }