Log level warning doesn't work

Elastic Stack Beats
1

I have this config file:

filebeat.prospectors:
- type: log
  enabled: true
  paths:
    - /var/log/messages
    - /var/log/secure
    - /var/log/audit/audit.log
    - /var/log/yum.log
    - /root/.bash_history
    - /var/log/neutron/*.log
    - /var/log/nova/*.log
    - /var/log/keystone/keystone.log
    - /var/log/httpd/error_log
    - /var/log/mariadb/mariadb.log
    - /var/log/glance/*.log
    - /var/log/rabbitmq/*.log
  exclude_files: ['/var/log/neutron/metadata-agent.log$']
  ignore_older: 72h
- type: log
  enabled: true
  logging.level: warning
  paths:
    - /var/log/neutron/metadata-agent.log
  ignore_older: 72h
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
output.logstash:
  hosts: []

My goal is in case of the metadata-agent.log I don't want to send the info logs, only everything else which is different from info like these:

2019-03-18 12:34:18.075 1183 TRACE neutron.agent.metadata.agent Exception: Unexpected response code: 504
2019-03-18 12:34:18.075 1183 TRACE neutron.agent.metadata.agent
2019-03-18 12:34:19.083 1186 ERROR neutron.agent.metadata.agent [-] Unexpected error.

But with this configuration the info is still sending. Where is the problem?

My filebeat version is 6.2

2

Looking at https://www.elastic.co/guide/en/beats/filebeat/6.2/configuration-filebeat-options.html, it doesn't appear that logging.level is a prospector setting. Instead logging.level is a global setting in filebeat.yml that applies to Filebeat's own logs (as opposed to any log files that Filebeat is harvesting).

It sounds like you want to exclude any INFO level messages from the /var/log/neutron/metadata-agent.log file that Filebeat is reading. You might want to look into the exclude_lines option, documented over here: https://www.elastic.co/guide/en/beats/filebeat/6.2/configuration-filebeat-options.html#exclude-lines.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.