Logstash Drop Lines


(Ricardo Augusto Santos) #1

Hi All.
I Have a Weblogic log how below:

Jan 7, 2019 5:29:13 PM com.clarify.common.filter.SearchFilterBaseWB Start doLoad() from SearchFilterBaseWB
INFO: ENTRY
Warning (Not critical): Query will be done against view. CBO :com.clarify.cbo.CboError: Inválido Bandeira Consulta. Bandeira ignorados. Consulta inicial não pode ser executado contra a tabela base. Vai fazer consulta inicial contra a visão.
Jan 7, 2019 5:29:14 PM com.clarify.common.search.SearchBaseLB End of SearchBaseLB Retrieve()
INFO: ENTRY
Jan 7, 2019 5:29:14 PM com.clarify.common.filter.SearchFilterBaseWB End doLoad() from SearchFilterBaseWB
INFO: ENTRY
Jan 7, 2019 5:29:14 PM com.clarify.common.filter.SearchFilterBaseWB processIncomingRequest
INFO: EXIT
line 1:12 mismatched input '=' expecting ';'
line 1:12 mismatched input '=' expecting ';'
line 1:12 mismatched input '=' expecting ';'

I'm using Logstash, Elasticsearch and Kibana. This is work fine.
But I need remove/drop lines below:

line 1:12 mismatched input '=' expecting ';'
line 1:12 mismatched input '=' expecting ';'
line 1:12 mismatched input '=' expecting ';'

I'm using filter below:
filter {
if ([message] == "(line.+?.+')") {
drop {}
}

grok {
match => { "message" => "%{COMBINEDAPACHELOG}"}
}
}

And so, as lines still appear. What can it be?


#2

Replace == with =~


(Ricardo Augusto Santos) #3

Pls,
Close this topic


(system) closed #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.