How to filter only error logs using filebeat

Elastic Stack Beats
1

Hello,
i have a log file that contains INFO,WARN and ERROR like :

[17:37:17.103] [ERROR] [...] [.....]

these are log4j logs.
Using filebeat, I want to filter out only those logs with log level ERROR and send them to logstash, can anybody tell me how to do this?
Thank you for any help.

2

Hi @Anindita_Chavan

You can filter incoming log messages using filters and processors https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html

3

Hello @Mario_Castro,
But isn't that solution for logs that start with the word ERROR INFO or DEBUG? What do I do if there is a timestamp in the beginning?
Thank You.

4

It's a regex what you can use there. You can pretty much do everything with it (including working around the timestamp)