How to send what you want in filebeat

Elastic Stack Beats
1

How can I send only those lines which i want from filebeat to logstash

2

You need to define a pattern to match the lines you want to send using the include_lines.

Here is the documentation about how to do it.

3

I tried include_lines, it worked well when i tried one filter. But i want multiple filter and if i give same way as given in filebeat.yml file by default. Then it did not worked. It only filters first term.

4

The include_lines is a list of regular expressions, if you want to filter on more than one expression you will need to add an item to that list.

include_lines: ['EXP1', 'EXP2', 'EXP3', 'EXPN']

How are you trying to do? Please share your configuration using the Preformatted text option, the </> button.

5

Now its working for me, thanks for your response @leandrojmp

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.