How to filter log level with json in filebeat

Elastic Stack Beats
1

Continuing the discussion from Parse JSON data with filebeat:

2

You can filter based on the level string by using a drop_event processors.

This configuration is valid for 6.0+.

filebeat.prospectors:
- paths:
  - /my/path/log.txt
  json.keys_under_root: true
  json.add_error_key: true
  processors:
  - drop_event.when.regexp.level: '^debug$'

If you are 5.x then you can apply the processor at the global level affecting all prospectors.

filebeat.prospectors:
- paths:
  - /my/path/log.txt
  json.keys_under_root: true
  json.add_error_key: true

processors:
- drop_event.when.regexp.level: '^debug$'
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.