# How to drop multiple message names using filebeat

**URL:** <https://discuss.elastic.co/t/how-to-drop-multiple-message-names-using-filebeat/165551>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 24, 2019, 8:18am UTC](https://discuss.elastic.co/t/how-to-drop-multiple-message-names-using-filebeat/165551 "2019-01-24T08:18:16Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![balamelangi](https://avatars.discourse-cdn.com/v4/letter/b/c77e96/32.png) [@balamelangi](https://discuss.elastic.co/u/balamelangi)\
**Post date:** [January 24, 2019, 8:18am UTC](https://discuss.elastic.co/t/how-to-drop-multiple-message-names-using-filebeat/165551/1 "2019-01-24T08:18:16Z")

</div>

Hi,

Please some one help me how to drop lines using filebeat. My code is,

```
 processors: 
  - drop_event: 
      when: 
        contains: 
          message: ["AbstractLoggingWriter", "WARN"]

```

and

```
 processors: 
  - drop_event: 
      when: 
        contains: 
          message: 
            - AbstractLoggingWriter
            - WARN

```

and

I'm getting both logs :  
2019-01-24 08:08:30,291 WARN OSS com.pronto.util.CacheErrorMessage.getMessage(CacheErrorMessage.java:97) - Error Message id - ' wisp id : 16, franchisee id : 1527577560571, location id : 1527592878683, messageCode : CustomerFUPInfo' is Null.  
2019-01-24 07:47:18,912 ERROR stderr org.jboss.stdio.AbstractLoggingWriter.write(AbstractLoggingWriter.java:71) - In TemplateProvider.locate()  
2019-01-24 07:47:18,912 ERROR stderr org.jboss.stdio.AbstractLoggingWriter.write(AbstractLoggingWriter.java:71) - DD.ServiceClass: org.apache.soap.providers.StatelessEJBProvider

By using above code I'm unable to drop\_lines containing.

But If I try to below :

```
 processors: 
  - drop_event: 
      when: 
        contains: 
          message: "AbstractLoggingWriter"

```

drops all the messages containing **AbstractLoggingWriter**. I want to block or drop lines containing **AbstractLoggingWriter** and **WARN**. Please some one help me.

Thanks.

---

<div class="post-metadata">

**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Post date:** [January 24, 2019, 9:57am UTC](https://discuss.elastic.co/t/how-to-drop-multiple-message-names-using-filebeat/165551/2 "2019-01-24T09:57:44Z")

</div>

Hello @balamelangi,

Use this to exclude lines

exclude\_lines: ['_AbstractLoggingWriter_']

> [@Filebeat exclude line not working frowning](https://discuss.elastic.co/t/filebeat-exclude-line-not-working/113358/3):
>
> @robscott27 You are awesome!!!!! I followed your example for the nginx config file at /usr/share/filebeat/module/nginx/access/config/nginx-access.yml Added this last line to the bottom type: log paths: {{ range $i, $path := .paths }} - {{$path}} {{ end }} exclude\_files: [".gz$"] exclude\_lines: ['.\*feedback.\*'] And now it works as expected!!!! Thank you so much!! Wish I would have found that post earlier! Have been beating my head against the wall for days.

Hope this works for you

Regards  
Shrikant

---

<div class="post-metadata">

**Author:** ![balamelangi](https://avatars.discourse-cdn.com/v4/letter/b/c77e96/32.png) [@balamelangi](https://discuss.elastic.co/u/balamelangi)\
**Post date:** [January 24, 2019, 10:07am UTC](https://discuss.elastic.co/t/how-to-drop-multiple-message-names-using-filebeat/165551/3 "2019-01-24T10:07:11Z")

</div>

Thanks for your reply @shrikantgulia .

I'm using 5.6.14 version filebeat. So, I think exclude\_lines option is not working.

```
 processors: 
  - drop_event: 
      when: 
        contains: 
          message: "AbstractLoggingWriter"

```

The above one is working. But coming to drop two different words not working. If you know please let me.

Thanks.

---

<div class="post-metadata">

**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Post date:** [January 24, 2019, 10:27am UTC](https://discuss.elastic.co/t/how-to-drop-multiple-message-names-using-filebeat/165551/4 "2019-01-24T10:27:14Z")

</div>

Hello @balamelangi,

I think its the same

[https://www.elastic.co/guide/en/beats/filebeat/5.6/configuration-filebeat-options.html](https://www.elastic.co/guide/en/beats/filebeat/5.6/configuration-filebeat-options.html)

---

<div class="post-metadata">

**Author:** ![balamelangi](https://avatars.discourse-cdn.com/v4/letter/b/c77e96/32.png) [@balamelangi](https://discuss.elastic.co/u/balamelangi)\
**Post date:** [January 24, 2019, 10:36am UTC](https://discuss.elastic.co/t/how-to-drop-multiple-message-names-using-filebeat/165551/5 "2019-01-24T10:36:45Z")

</div>

No. This is not same.

---

<div class="post-metadata">

**Author:** ![balamelangi](https://avatars.discourse-cdn.com/v4/letter/b/c77e96/32.png) [@balamelangi](https://discuss.elastic.co/u/balamelangi)\
**Post date:** [January 24, 2019, 10:51am UTC](https://discuss.elastic.co/t/how-to-drop-multiple-message-names-using-filebeat/165551/6 "2019-01-24T10:51:50Z")

</div>

@adrisr can you please help me.

I'm trying to drop events with multiple words like :

```
   AbstractLoggingWriter and WARN.

```

Thanks.

---

<div class="post-metadata">

**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Post date:** [January 24, 2019, 10:54am UTC](https://discuss.elastic.co/t/how-to-drop-multiple-message-names-using-filebeat/165551/7 "2019-01-24T10:54:12Z")

</div>

@balamelangi  
can you please add array.

like ["AbstractLoggingWriter", "WARN"]

---

<div class="post-metadata">

**Author:** ![balamelangi](https://avatars.discourse-cdn.com/v4/letter/b/c77e96/32.png) [@balamelangi](https://discuss.elastic.co/u/balamelangi)\
**Post date:** [January 24, 2019, 10:58am UTC](https://discuss.elastic.co/t/how-to-drop-multiple-message-names-using-filebeat/165551/8 "2019-01-24T10:58:21Z")

</div>

@shrikantgulia  
Already I tried :  
**like ["AbstractLoggingWriter", "WARN"]** is not working.

Even **AbstractLoggingWriter** also not droping.

Thanks.

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [January 24, 2019, 11:43am UTC](https://discuss.elastic.co/t/how-to-drop-multiple-message-names-using-filebeat/165551/9 "2019-01-24T11:43:27Z")

</div>

What you want is to use "and" in your condition:

```auto
processors: 
  - drop_event: 
      when: 
        and:
        - contains: 
            message: AbstractLoggingWriter
        - contains: 
            message: WARN

```

This will drop all events that contain AbstractLoggingWriter and WARN at the same time.

---

<div class="post-metadata">

**Author:** ![balamelangi](https://avatars.discourse-cdn.com/v4/letter/b/c77e96/32.png) [@balamelangi](https://discuss.elastic.co/u/balamelangi)\
**Post date:** [January 24, 2019, 12:06pm UTC](https://discuss.elastic.co/t/how-to-drop-multiple-message-names-using-filebeat/165551/10 "2019-01-24T12:06:18Z")

</div>

@adrisr

No. I want **WARN** and **AbstractLoggingWriter** is separate logs. Not bot are in one line.

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 21, 2019, 12:06pm UTC](https://discuss.elastic.co/t/how-to-drop-multiple-message-names-using-filebeat/165551/11 "2019-02-21T12:06:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.