How to drop event in logstash

Elastic Stack Logstash
1

I want drop logfile mean shoudn't export to elasticsearch, like if any log message contains "monitoring" keyword i want to drop that event. can any anyone suggest me how to do that ?

filter {
  if [loglevel] == "debug" {
    drop { }
  }
}

The above example will drop the event when loglevel debug, but drop event when log message contains "monitoring" keyword

2 
if "monitoring" in [message] {
3

@magnusbaeck thanks it worked. how to set 2 keywords?

example :

if "monitoring" and " harvestor" in [message] {

4 
if "x" in [message] and "y" in [message] {

You can also use a regular expression.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.