# Include\_lines doesn't seem to work

**URL:** <https://discuss.elastic.co/t/include-lines-doesnt-seem-to-work/55299>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 12, 2016, 2:13pm UTC](https://discuss.elastic.co/t/include-lines-doesnt-seem-to-work/55299 "2016-07-12T14:13:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dan2](https://avatars.discourse-cdn.com/v4/letter/d/74df32/32.png) [@Dan2](https://discuss.elastic.co/u/Dan2)\
**Post date:** [July 12, 2016, 2:13pm UTC](https://discuss.elastic.co/t/include-lines-doesnt-seem-to-work/55299/1 "2016-07-12T14:13:02Z")

</div>

Hi,  
I've configured the include\_lines to show only a line with the word "WARN" but I'm getting all the lines in the log file without any filter.

this is my config file:

```auto
################### Filebeat Configuration Example #########################

############################# Filebeat ######################################
filebeat:
  # List of prospectors to fetch data.
  prospectors:
    # Each - is a prospector. Below are the prospector specific configurations
    -

      paths:
        - C:\nexperience\logs\handsets\np_hs.VIRTUAL.03.log

      encoding: plain

      input_type: log

      # Include lines. A list of regular expressions to match. It exports the lines that are
      # matching any regular expression from the list. The include_lines is called before
      # exclude_lines. By default, all the lines are exported.
      include_lines: ["WARN"]

  # General filebeat configuration options
  #
  # Event count spool threshold - forces network flush if exceeded
  #spool_size: 10000

  # Enable async publisher pipeline in filebeat (Experimental!)
  #publish_async: false

  # Defines how often the spooler is flushed. After idle_timeout the spooler is
  # Flush even though spool_size is not reached.
  #idle_timeout: 5s

  # Name of the registry file. Per default it is put in the current working
  # directory. In case the working directory is changed after when running
  # filebeat again, indexing starts from the beginning again.
  registry_file: "C:/ProgramData/filebeat/registry"

  # Full Path to directory with additional prospector configuration files. Each file must end with .yml
  # These config files must have the full filebeat config part inside, but only
  # the prospector part is processed. All global options like spool_size are ignored.
  # The config_dir MUST point to a different directory then where the main filebeat config file is in.
  #config_dir:

###############################################################################
############################# Libbeat Config ##################################
# Base config file used by all other beats for using libbeat features

############################# Output ##########################################

# Configure what outputs to use when sending the data collected by the beat.
# Multiple outputs may be used.
output:

  ### File as output
  file:
    # Path to the directory where to save the generated files. The option is mandatory.
    path: "/tmp/filebeat"

    # Name of the generated files. The default is `filebeat` and it generates files: `filebeat`, `filebeat.1`, `filebeat.2`, etc.
    #filename: filebeat

    # Maximum size in kilobytes of each file. When this size is reached, the files are
    # rotated. The default value is 10 MB.
    #rotate_every_kb: 10000

    # Maximum number of files under path. When this number of files is reached, the
    # oldest file is deleted and the rest are shifted from last to first. The default
    # is 7 files.
    #number_of_files: 7

  ### Console output
  # console:
    # Pretty print json event
    #pretty: false

############################# Shipper #########################################

shipper:

  # Configure local GeoIP database support.
  # If no paths are not configured geoip is disabled.
  #geoip:
    #paths:
    # - "/usr/share/GeoIP/GeoLiteCity.dat"
    # - "/usr/local/var/GeoIP/GeoLiteCity.dat"

############################# Logging #########################################

# There are three options for the log ouput: syslog, file, stderr.
# Under Windos systems, the log files are per default sent to the file output,
# under all other system per default to syslog.
logging:

  # Send all logging output to syslog. On Windows default is false, otherwise
  # default is true.
  #to_syslog: true

  # Write all logging output to files. Beats automatically rotate files if rotateeverybytes
  # limit is reached.
  #to_files: false

  # To enable logging to files, to_files option has to be set to true
  files:
    # The directory where the log files will written to.
    #path: /var/log/mybeat

    # The name of the files where the logs are written to.
    #name: mybeat

    # Configure log file size limit. If limit is reached, log file will be
    # automatically rotated
    rotateeverybytes: 10485760 # = 10MB

    # Number of rotated log files to keep. Oldest files will be deleted first.
    #keepfiles: 7

  # Enable debug output for selected components. To enable all selectors use ["*"]
  # Other available selectors are beat, publish, service
  # Multiple selectors can be chained.
  #selectors: []

  # Sets log level. The default log level is error.
  # Available log levels are: critical, error, warning, info, debug
  #level: error

```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 13, 2016, 6:50am UTC](https://discuss.elastic.co/t/include-lines-doesnt-seem-to-work/55299/2 "2016-07-13T06:50:56Z")

</div>

What does your data look like?

---

<div class="post-metadata">

**Author:** ![Dan2](https://avatars.discourse-cdn.com/v4/letter/d/74df32/32.png) [@Dan2](https://discuss.elastic.co/u/Dan2)\
**Post date:** [July 13, 2016, 7:58am UTC](https://discuss.elastic.co/t/include-lines-doesnt-seem-to-work/55299/3 "2016-07-13T07:58:41Z")

</div>

Thanks for the reply butI solved it, I used an old version of Filebeat, an update had solved it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 2, 2016, 2:13pm UTC](https://discuss.elastic.co/t/include-lines-doesnt-seem-to-work/55299/4 "2016-08-02T14:13:05Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.