Logstash drop data

Hi Guys

I am having an issue with the logstash drop filter.

I am getting 2 types of data via filebeat from couple of servers, and i want to drop anything that is with json type.

In filebeat, I have following config

- input_type: log
  paths:
- "/var/log/abc/tomcat/development/support/support.json"
  document_type: "webapp"
  json.keys_under_root: true
  fields:
environment: "development"
webapp: "support"
type: "json"

And below is what i have in logstash

filter {

                if [type] == "json" {
                        drop { }
               }

               else if [fields.type] == "json" {
                        drop { }
               }
}

I can't change the servers to not stop sending json.

Any help would be great.

Thanks,
Junaid

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.