# How to discard entire lines of input

**URL:** <https://discuss.elastic.co/t/how-to-discard-entire-lines-of-input/2139>\
**Category:** Logstash\
**Created:** [June 8, 2015, 3:03pm UTC](https://discuss.elastic.co/t/how-to-discard-entire-lines-of-input/2139 "2015-06-08T15:03:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![bdunbar](https://avatars.discourse-cdn.com/v4/letter/b/a3d4f5/32.png) [@bdunbar](https://discuss.elastic.co/u/bdunbar)\
**Post date:** [June 8, 2015, 3:03pm UTC](https://discuss.elastic.co/t/how-to-discard-entire-lines-of-input/2139/1 "2015-06-08T15:03:34Z")

</div>

I have input coming from eight Apache webservers. Included in these logs are a fair bit of inter-cluster traffic. I'd like to not include this in my results, as they aren't users, just the servers running a health check.

I know which lines I don't want, can discard either on the GET request or the IP.

I see how grok will let me remove tags, and fields, but how do I discard entire _lines_ of input?

Reference: apache.conf file

filter {  
if [type] == "apache" {  
grok {  
match =\> { "message" =\> "%{COMBINEDAPACHELOG}" }  
}  
geoip {  
source =\> "clientip"  
target =\> "geoip"  
database =\> "/etc/logstash/GeoLiteCity.dat"  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ]  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ]  
}  
mutate {  
convert =\> ["[geoip][coordinates]", "float"]  
}  
}  
}

Sample log line I want (sanitized)

108.121.141.101 - - [08/Jun/2015:07:35:12 -0700] "GET /foo/bar/galleries/bat.jpg HTTP/1.1" 304 - "[http://www.client.com/members/biz](http://www.client.com/members/biz)" "Mozilla/5.0 (iPhone; CPU iPhone OS 8\_3 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) CriOS/43.0.2357.51 Mobile/12F70 Safari/600.1.4" usrid="-" "-"

Sample log line I don't want

108.121.141.101 - - [08/Jun/2015:07:35:12 -0700] "GET /foo/bar/galleries/bat.jpg HTTP/1.1" 304 - "[http://www.client.com/members/biz](http://www.client.com/members/biz)" "Mozilla/5.0 (iPhone; CPU iPhone OS 8\_3 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) CriOS/43.0.2357.51 Mobile/12F70 Safari/600.1.4" usrid="-" "-"

---

<div class="post-metadata">

**Author:** ![bdunbar](https://avatars.discourse-cdn.com/v4/letter/b/a3d4f5/32.png) [@bdunbar](https://discuss.elastic.co/u/bdunbar)\
**Post date:** [June 8, 2015, 3:11pm UTC](https://discuss.elastic.co/t/how-to-discard-entire-lines-of-input/2139/3 "2015-06-08T15:11:33Z")

</div>

I believe I found the correct drop-in: drop. As in

if [request] == "/the/healhcheck.php" {  
drop { }  
}

---

<div class="post-metadata">

**Author:** ![bdunbar](https://avatars.discourse-cdn.com/v4/letter/b/a3d4f5/32.png) [@bdunbar](https://discuss.elastic.co/u/bdunbar)\
**Post date:** [June 8, 2015, 6:20pm UTC](https://discuss.elastic.co/t/how-to-discard-entire-lines-of-input/2139/4 "2015-06-08T18:20:17Z")

</div>

But now I have a problem and I don't quite see how to fix it.

I can't, as it happens, drop lines based on content in 'request'. I can for clientIP, but I don't see how to address multiple client IPs.

This fails

```
if [clientip] == "10.1.88.11, 10.1.88.12, 10.1.88.13, 10.1.88.14, 10.1.88.15, 10.1.88.16, 10.1.42.117, 10.1.42.118, 10.1.42.119" {
   drop {}
}

```

This works, but isn't elegant

if [clientip] == "10.1.88.11" {  
drop {}  
}  
if [clientip] == "10.1.88.12" {  
drop {}  
}  
if [clientip] == "10.1.88.13" {  
drop {}  
}

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [June 8, 2015, 7:30pm UTC](https://discuss.elastic.co/t/how-to-discard-entire-lines-of-input/2139/5 "2015-06-08T19:30:58Z")

</div>

Slightly more elegant:

```
if [clientip] in ["10.1.88.11", "10.1.88.12", "10.1.88.13", "10.1.88.14", "10.1.88.15", "10.1.88.16", "10.1.42.117", "10.1.42.118", "10.1.42.119"] {
  drop {}
}

```

You can use "in" to see if an entry is within an array.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:38am UTC](https://discuss.elastic.co/t/how-to-discard-entire-lines-of-input/2139/6 "2017-07-06T05:38:09Z")

</div>

Closed on July 6, 2017, 5:38am UTC