# I don't want all data output to the elasticsearch

**URL:** <https://discuss.elastic.co/t/i-dont-want-all-data-output-to-the-elasticsearch/98030>\
**Category:** Logstash\
**Created:** [August 23, 2017, 8:37am UTC](https://discuss.elastic.co/t/i-dont-want-all-data-output-to-the-elasticsearch/98030 "2017-08-23T08:37:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [August 23, 2017, 8:37am UTC](https://discuss.elastic.co/t/i-dont-want-all-data-output-to-the-elasticsearch/98030/1 "2017-08-23T08:37:36Z")

</div>

I found that the filter plugin can't filter wrong format message and all data would output to the elasticsearch.  
If I want to filter out wrong data let wrong data can't output to the elasticsearch ,how can I do.  
this is my conf:

```
input {
    stdin { }
}
filter {
    if[type]=="syslog"{
       grok {
       match => { "message" => '<%{NONNEGINT:syslog_pri}>%{GREEDYDATA:fgtlogmsg}'
     }
     }	
kv {
      source => "fgtlogmsg"
   }
   syslog_pri { }
  }
}
output {
elasticsearch { hosts => ["localhost:9200"] }
stdout { codec => rubydebug }
}

```

if I input message such as "123456Test", it also output to the elasticsearch  
thank you in advance

---

<div class="post-metadata">

**Author:** ![tatdat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tatdat/32/113160_2.png) [@tatdat](https://discuss.elastic.co/u/tatdat)\
**Post date:** [August 23, 2017, 9:46am UTC](https://discuss.elastic.co/t/i-dont-want-all-data-output-to-the-elasticsearch/98030/2 "2017-08-23T09:46:58Z")

</div>

> [@f26227279](#):
>
> output {  
> elasticsearch { hosts =\> ["localhost:9200"] }  
> stdout { codec =\> rubydebug }  
> }

Your mean is drop message, that can't filter by grok?

```
filter {
	if[type]=="syslog"{
		grok {
			match => { "message" => '<%{NONNEGINT:syslog_pri}>%{GREEDYDATA:fgtlogmsg}'}
		}	
		kv {
			source => "fgtlogmsg"
		}
		syslog_pri { }
	}
	if "_grokparsefailure" in [tag] {
		drop { }
	}
}

```

Or

```
output {
	if "_grokparsefailure" not in [tag] {
		elasticsearch { hosts => ["localhost:9200"] }
		stdout { codec => rubydebug }
	}
	
}

```

---

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [August 23, 2017, 10:15am UTC](https://discuss.elastic.co/t/i-dont-want-all-data-output-to-the-elasticsearch/98030/3 "2017-08-23T10:15:13Z")

</div>

tatdat,  
Thank you 😊 this is answer what I want 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 20, 2017, 10:15am UTC](https://discuss.elastic.co/t/i-dont-want-all-data-output-to-the-elasticsearch/98030/4 "2017-09-20T10:15:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.