# How to reject incoming logs easily?

**URL:** <https://discuss.elastic.co/t/how-to-reject-incoming-logs-easily/158529>\
**Category:** Logstash\
**Created:** [November 28, 2018, 9:47am UTC](https://discuss.elastic.co/t/how-to-reject-incoming-logs-easily/158529 "2018-11-28T09:47:58Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![pwny](https://avatars.discourse-cdn.com/v4/letter/p/ecc23a/32.png) [@pwny](https://discuss.elastic.co/u/pwny)\
**Post date:** [November 28, 2018, 9:47am UTC](https://discuss.elastic.co/t/how-to-reject-incoming-logs-easily/158529/1 "2018-11-28T09:47:58Z")

</div>

Hello,

we have a small Elastic Stack setup.  
There are several sources that are frequently sending logs to Logstash but they are not needed anymore.  
However to some I don't have access to and the person responsible doesn't seem to be interested in turning it off (Logs are being send directly from devices not through beats).  
This made me wonder if there was an easy way to reject certain incoming logs on Logstash in the best way.  
I could use something like another Logstash server which sends the logs to a broker like rabbitMQ which sends them to another logstash server again, but that seems overkill for my use case.  
I don't want to close the port, as there a lot of machines sending their logs to it (tcp input plugin).  
I can't seem to find anything useful, maybe I'm searching for the wrong terms.

Do you know a good way to reject unwanted logs in Logstash?

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [November 28, 2018, 9:51am UTC](https://discuss.elastic.co/t/how-to-reject-incoming-logs-easily/158529/2 "2018-11-28T09:51:17Z")

</div>

Just simply use the "drop" filter.

You can do conditional drops such as:

```
if [host] == "ip address or hostname" {
   mutate {
        drop { }
   }
}
```

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [November 28, 2018, 1:39pm UTC](https://discuss.elastic.co/t/how-to-reject-incoming-logs-easily/158529/3 "2018-11-28T13:39:39Z")

</div>

Note that `drop` is a filter in its own right and not a sub-function of the mutate filter.

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [November 28, 2018, 1:40pm UTC](https://discuss.elastic.co/t/how-to-reject-incoming-logs-easily/158529/4 "2018-11-28T13:40:27Z")

</div>

Apologies, this is correct!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 26, 2018, 1:40pm UTC](https://discuss.elastic.co/t/how-to-reject-incoming-logs-easily/158529/5 "2018-12-26T13:40:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.