Ignore log record if log does not contain specific string "jenkins_build_number"

You can use a conditional to check if the field does not exist and drop it, just put it after the grok filter where you create the field.

if ![jenkins_build_number] {
    drop {}
}

But since you create it in a grok filter and you do not have the field in some message, they probably have the tag _grokparsefailure, which you can also use to drop messages.

if "_grokparsefailure" in [tags] {
    drop {}
}
1 Like