How to filter data from beat in logstash

Elastic Stack Logstash
1

Hello. I need to add data comes from beats to ElasticSearch. But before I need to filter to keep only records that have "status" and status is not "sent". I wrote next configuration for it.

input {
  beats {
    port => 5055
  }
}

filter {
  if ["status="] not in [message] {
    drop{}
  }
  if ["status=sent"] in [message] {
    drop{}
  }
}

As result I got "TypeError: can't convert nil into String". I suppose the reason is "message" field but I didn't manage to understand the name of field that contain all text. Thanks for responses.

PS: The data to beats sent from filebeat.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.