Logstash filter doesn't appear to be functioning

Elastic Stack Logstash
1

Hello,

Logstash version: 6.8.23

data

message: cmd_logger_api.c(260) 10987641 %% INFO [CLI:backupguy:10.0.1.254] User has logged out
type: rsyslog

Logstash filter:

filter {
if "backupguy" in [message] { drop {} }
}
Problem:

I still seem to be getting the string backupguy in the message field created in Elasticsearch anyone have any ideas why?

2

Please show us exactly what the [message] field looks like in either rubydebug or JSON markup. That conditional would fail if [message] is an array (or even a hash), there may be other reasons too.

3

Have you restarted LS after added drop?

Also you can use regex
if [message] =~ /backupguy/ {