How to drop multiple message names using filebeat

Elastic Stack Beats
1

Hi,

Please some one help me how to drop lines using filebeat. My code is,

 processors: 
  - drop_event: 
      when: 
        contains: 
          message: ["AbstractLoggingWriter", "WARN"]

and

 processors: 
  - drop_event: 
      when: 
        contains: 
          message: 
            - AbstractLoggingWriter
            - WARN

and

I'm getting both logs :
2019-01-24 08:08:30,291 WARN OSS com.pronto.util.CacheErrorMessage.getMessage(CacheErrorMessage.java:97) - Error Message id - ' wisp id : 16, franchisee id : 1527577560571, location id : 1527592878683, messageCode : CustomerFUPInfo' is Null.
2019-01-24 07:47:18,912 ERROR stderr org.jboss.stdio.AbstractLoggingWriter.write(AbstractLoggingWriter.java:71) - In TemplateProvider.locate()
2019-01-24 07:47:18,912 ERROR stderr org.jboss.stdio.AbstractLoggingWriter.write(AbstractLoggingWriter.java:71) - DD.ServiceClass: org.apache.soap.providers.StatelessEJBProvider

By using above code I'm unable to drop_lines containing.

But If I try to below :

 processors: 
  - drop_event: 
      when: 
        contains: 
          message: "AbstractLoggingWriter"

drops all the messages containing AbstractLoggingWriter . I want to block or drop lines containing AbstractLoggingWriter and WARN. Please some one help me.

Thanks.

2

Hello @balamelangi,

Use this to exclude lines

exclude_lines: ['AbstractLoggingWriter']

Hope this works for you

Regards
Shrikant

3

Thanks for your reply @shrikantgulia .

I'm using 5.6.14 version filebeat. So, I think exclude_lines option is not working.

 processors: 
  - drop_event: 
      when: 
        contains: 
          message: "AbstractLoggingWriter"

The above one is working. But coming to drop two different words not working. If you know please let me.

Thanks.

4

Hello @balamelangi,

I think its the same

https://www.elastic.co/guide/en/beats/filebeat/5.6/configuration-filebeat-options.html

5

No. This is not same.

6

@adrisr can you please help me.

I'm trying to drop events with multiple words like :

   AbstractLoggingWriter  and WARN.

Thanks.

7

@balamelangi
can you please add array.

like ["AbstractLoggingWriter", "WARN"]

8

@shrikantgulia
Already I tried :
like ["AbstractLoggingWriter", "WARN"] is not working.

Even AbstractLoggingWriter also not droping.

Thanks.

9

What you want is to use "and" in your condition:

processors: 
  - drop_event: 
      when: 
        and:
        - contains: 
            message: AbstractLoggingWriter
        - contains: 
            message: WARN

This will drop all events that contain AbstractLoggingWriter and WARN at the same time.

1 Like
10

@adrisr

No. I want WARN and AbstractLoggingWriter is separate logs. Not bot are in one line.

Thanks.

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.