# Logstash eventlog filter

**URL:** <https://discuss.elastic.co/t/logstash-eventlog-filter/51316>\
**Category:** Logstash\
**Created:** [May 30, 2016, 12:24pm UTC](https://discuss.elastic.co/t/logstash-eventlog-filter/51316 "2016-05-30T12:24:09Z")\
**Posts on this page:** 7\
**Page:** 2

<div class="post-metadata">

**Author:** ![babeesh](https://avatars.discourse-cdn.com/v4/letter/b/e47c2d/32.png) [@babeesh](https://discuss.elastic.co/u/babeesh)\
**Post date:** [June 10, 2016, 6:29am UTC](https://discuss.elastic.co/t/logstash-eventlog-filter/51316/21 "2016-06-10T06:29:43Z")

</div>

My understanding is, the **if** condition in output,

```
if "error" in [tags] {
elasticsearch {
hosts => ["172.30.0.206:9200"]
}

```

will only send logs having "error " in tags to ES. So if no "error" , that logs must be skipped. But it is not happening.

Logstash is starting with command **sudo service logstash start**

---

<div class="post-metadata">

**Author:** ![bryan\_stuhlsatz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bryan_stuhlsatz/32/49123_2.png) [@bryan\_stuhlsatz](https://discuss.elastic.co/u/bryan_stuhlsatz)\
**Post date:** [June 11, 2016, 1:40pm UTC](https://discuss.elastic.co/t/logstash-eventlog-filter/51316/22 "2016-06-11T13:40:07Z")

</div>

In your above (earlier post), you are missing a curly brace. Not sure that is the issue, but your output is not properly terminated. You need 1 } at the bottom of output.

should look like this:

output {  
if "error" in [tags] {  
elasticsearch {  
hosts =\> ["172.30.0.206:9200"]  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![mourlos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mourlos/32/10788_2.png) [@mourlos](https://discuss.elastic.co/u/mourlos)\
**Post date:** [June 12, 2016, 9:21am UTC](https://discuss.elastic.co/t/logstash-eventlog-filter/51316/23 "2016-06-12T09:21:00Z")

</div>

Hi,

I tried your configuration with the only difference that I used winlogbeat instead of nxlog (and different field names: **level** instead of **Severity** ) and it works ok.

I am not sure what is the issue there.

As a diferent solution you can try **drop** filter. I am using this to remove very noisy events. As an example in you case it will be something like this:

```auto
#####Match type and level.
filter {
  # Drop informational events
  if [type] == "eventlog" and [Severity] == "WARNING" {
    drop { }
  }
# Drop warning events
  if [type] == "eventlog" and [Severity] == "INFO" {
    drop { }
  }
}
```

\*(Before you use this -if you do- check and make sure that the field names and values correspond to yours)

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 13, 2016, 5:49am UTC](https://discuss.elastic.co/t/logstash-eventlog-filter/51316/24 "2016-06-13T05:49:45Z")

</div>

> Logstash is starting with command sudo service logstash start

Make sure you don't have any unexpected files in /etc/logstash/conf.d. Logstash will read _all_ files. Specifically, make sure you don't have a file containing an elasticsearch output that isn't wrapped in a conditional.

---

<div class="post-metadata">

**Author:** ![babeesh](https://avatars.discourse-cdn.com/v4/letter/b/e47c2d/32.png) [@babeesh](https://discuss.elastic.co/u/babeesh)\
**Post date:** [June 13, 2016, 12:46pm UTC](https://discuss.elastic.co/t/logstash-eventlog-filter/51316/25 "2016-06-13T12:46:54Z")

</div>

There was an unwanted file in conf.d folder. I deleted that and used drop filter by @mourlos .  
And now its working. I am getting only ERROR messages .  
But there is a new issue while getting logs in hipchat. I have raised a new query for it.

Anyway thank you very much.

---

<div class="post-metadata">

**Author:** ![babeesh](https://avatars.discourse-cdn.com/v4/letter/b/e47c2d/32.png) [@babeesh](https://discuss.elastic.co/u/babeesh)\
**Post date:** [June 13, 2016, 12:47pm UTC](https://discuss.elastic.co/t/logstash-eventlog-filter/51316/26 "2016-06-13T12:47:34Z")

</div>

Your idea worked for me. Thanks 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:53am UTC](https://discuss.elastic.co/t/logstash-eventlog-filter/51316/27 "2017-07-06T04:53:19Z")

</div>



[Previous page](https://discuss.elastic.co/t/logstash-eventlog-filter/51316.md?page=1)