# Log Filtering in ELK Stack

**URL:** <https://discuss.elastic.co/t/log-filtering-in-elk-stack/133588>\
**Category:** Elasticsearch\
**Created:** [May 28, 2018, 10:29pm UTC](https://discuss.elastic.co/t/log-filtering-in-elk-stack/133588 "2018-05-28T22:29:56Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![abhat](https://avatars.discourse-cdn.com/v4/letter/a/8e8cbc/32.png) [@abhat](https://discuss.elastic.co/u/abhat)\
**Post date:** [May 28, 2018, 10:29pm UTC](https://discuss.elastic.co/t/log-filtering-in-elk-stack/133588/1 "2018-05-28T22:29:56Z")

</div>

Hi Team,

I am new to ELK stack and I just setup an ELK stack which collects logs from tomcat log directory.

My requirement is it should only capture **SEVERE** AND **ERROR** messages in the log files present in the log directory.

Any ideas how to achieve it ?

Kind Regards,  
Asif Bhat

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 28, 2018, 10:33pm UTC](https://discuss.elastic.co/t/log-filtering-in-elk-stack/133588/2 "2018-05-28T22:33:43Z")

</div>

Use a conditional in Logstash with a drop filter and you should be good.

---

<div class="post-metadata">

**Author:** ![abhat](https://avatars.discourse-cdn.com/v4/letter/a/8e8cbc/32.png) [@abhat](https://discuss.elastic.co/u/abhat)\
**Post date:** [May 28, 2018, 10:39pm UTC](https://discuss.elastic.co/t/log-filtering-in-elk-stack/133588/3 "2018-05-28T22:39:40Z")

</div>

Thanks a lot Mark.

Any general document link that can be helpful here.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 28, 2018, 10:54pm UTC](https://discuss.elastic.co/t/log-filtering-in-elk-stack/133588/4 "2018-05-28T22:54:05Z")

</div>

[https://www.elastic.co/guide/en/logstash/6.2/config-examples.html#using-conditionals](https://www.elastic.co/guide/en/logstash/6.2/config-examples.html#using-conditionals)  
[https://www.elastic.co/guide/en/logstash/6.2/plugins-filters-drop.html](https://www.elastic.co/guide/en/logstash/6.2/plugins-filters-drop.html)

---

<div class="post-metadata">

**Author:** ![abhat](https://avatars.discourse-cdn.com/v4/letter/a/8e8cbc/32.png) [@abhat](https://discuss.elastic.co/u/abhat)\
**Post date:** [May 28, 2018, 11:01pm UTC](https://discuss.elastic.co/t/log-filtering-in-elk-stack/133588/5 "2018-05-28T23:01:40Z")

</div>

Fantastic!!! Thanks a lot.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 25, 2018, 11:01pm UTC](https://discuss.elastic.co/t/log-filtering-in-elk-stack/133588/6 "2018-06-25T23:01:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.