# Log level warning doesn't work

**URL:** <https://discuss.elastic.co/t/log-level-warning-doesnt-work/172709>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 18, 2019, 5:35am UTC](https://discuss.elastic.co/t/log-level-warning-doesnt-work/172709 "2019-03-18T05:35:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Badb0y](https://avatars.discourse-cdn.com/v4/letter/b/50afbb/32.png) [@Badb0y](https://discuss.elastic.co/u/Badb0y)\
**Post date:** [March 18, 2019, 5:35am UTC](https://discuss.elastic.co/t/log-level-warning-doesnt-work/172709/1 "2019-03-18T05:35:13Z")

</div>

I have this config file:

```
filebeat.prospectors:
- type: log
  enabled: true
  paths:
    - /var/log/messages
    - /var/log/secure
    - /var/log/audit/audit.log
    - /var/log/yum.log
    - /root/.bash_history
    - /var/log/neutron/*.log
    - /var/log/nova/*.log
    - /var/log/keystone/keystone.log
    - /var/log/httpd/error_log
    - /var/log/mariadb/mariadb.log
    - /var/log/glance/*.log
    - /var/log/rabbitmq/*.log
  exclude_files: ['/var/log/neutron/metadata-agent.log$']
  ignore_older: 72h
- type: log
  enabled: true
  logging.level: warning
  paths:
    - /var/log/neutron/metadata-agent.log
  ignore_older: 72h
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
output.logstash:
  hosts: []

```

My goal is in case of the metadata-agent.log I don't want to send the info logs, only everything else which is different from info like these:

```
2019-03-18 12:34:18.075 1183 TRACE neutron.agent.metadata.agent Exception: Unexpected response code: 504
2019-03-18 12:34:18.075 1183 TRACE neutron.agent.metadata.agent
2019-03-18 12:34:19.083 1186 ERROR neutron.agent.metadata.agent [-] Unexpected error.

```

But with this configuration the info is still sending. Where is the problem?

My filebeat version is 6.2

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [March 18, 2019, 6:45pm UTC](https://discuss.elastic.co/t/log-level-warning-doesnt-work/172709/2 "2019-03-18T18:45:22Z")

</div>

Looking at [https://www.elastic.co/guide/en/beats/filebeat/6.2/configuration-filebeat-options.html](https://www.elastic.co/guide/en/beats/filebeat/6.2/configuration-filebeat-options.html), it doesn't appear that `logging.level` is a prospector setting. Instead `logging.level` is a global setting in `filebeat.yml` that applies to Filebeat's own logs (as opposed to any log files that Filebeat is harvesting).

It sounds like you want to exclude any `INFO` level messages from the `/var/log/neutron/metadata-agent.log` file that Filebeat is reading. You might want to look into the `exclude_lines` option, documented over here: [https://www.elastic.co/guide/en/beats/filebeat/6.2/configuration-filebeat-options.html#exclude-lines](https://www.elastic.co/guide/en/beats/filebeat/6.2/configuration-filebeat-options.html#exclude-lines).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 15, 2019, 6:51pm UTC](https://discuss.elastic.co/t/log-level-warning-doesnt-work/172709/3 "2019-04-15T18:51:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.