# How to filter log level with json in filebeat

**URL:** https://discuss.elastic.co/t/how-to-filter-log-level-with-json-in-filebeat/112211
**Category:** Beats
**Tags:** filebeat
**Created:** [December 18, 2017, 10:33am UTC](https://discuss.elastic.co/t/how-to-filter-log-level-with-json-in-filebeat/112211 "2017-12-18T10:33:40Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![847e01e784615435d38b](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/847e01e784615435d38b/32/25748_2.png) [@847e01e784615435d38b](https://discuss.elastic.co/u/847e01e784615435d38b)
#### Post date: [December 18, 2017, 10:33am UTC](https://discuss.elastic.co/t/how-to-filter-log-level-with-json-in-filebeat/112211/1 "2017-12-18T10:33:41Z")

</div>

Continuing the discussion from [Parse JSON data with filebeat](https://discuss.elastic.co/t/parse-json-data-with-filebeat/80008/4):

> [@Parse JSON data with filebeat](https://discuss.elastic.co/t/parse-json-data-with-filebeat/80008/4):
>
> filebeat.prospectors:
> 
> - paths:
> - test.json  
> input\_type: log  
> json.keys\_under\_root: true  
> json.add\_error\_key: true
> 
> output.elasticsearch:  
> hosts: ["[http://localhost:9200](http://localhost:9200)"]

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [December 18, 2017, 2:39pm UTC](https://discuss.elastic.co/t/how-to-filter-log-level-with-json-in-filebeat/112211/2 "2017-12-18T14:39:33Z")

</div>

You can filter based on the level string by using a [drop\_event](https://www.elastic.co/guide/en/beats/filebeat/6.0/drop-event.html) processors.

This configuration is valid for 6.0+.

```auto
filebeat.prospectors:
- paths:
  - /my/path/log.txt
  json.keys_under_root: true
  json.add_error_key: true
  processors:
  - drop_event.when.regexp.level: '^debug$'

```

If you are 5.x then you can apply the processor at the global level affecting all prospectors.

```auto
filebeat.prospectors:
- paths:
  - /my/path/log.txt
  json.keys_under_root: true
  json.add_error_key: true

processors:
- drop_event.when.regexp.level: '^debug$'
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 15, 2018, 2:39pm UTC](https://discuss.elastic.co/t/how-to-filter-log-level-with-json-in-filebeat/112211/3 "2018-01-15T14:39:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.