# Logstash filter drop message with $ into string
**URL:** https://discuss.elastic.co/t/logstash-filter-drop-message-with-into-string/245784
**Category:** Logstash
**Tags:** windows
**Created:** [August 20, 2020, 2:51pm UTC](https://discuss.elastic.co/t/logstash-filter-drop-message-with-into-string/245784 "2020-08-20T14:51:15Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@davide.stallone](https://discuss.elastic.co/u/davide.stallone)
#### Post date: [August 20, 2020, 2:51pm UTC](https://discuss.elastic.co/t/logstash-filter-drop-message-with-into-string/245784/1 "2020-08-20T14:51:15Z")
Hi,
I'm trying to build a logstash filter to drop message that contains dollar at the end of string.
I'm receiving log from a domain controller and I would like to get message that has in the field "user.name" only real person so without dollar in the username.
I'm using last version of ELK stack.
Could you help me please?
Thank you.
---
### Author:  [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [August 20, 2020, 3:12pm UTC](https://discuss.elastic.co/t/logstash-filter-drop-message-with-into-string/245784/2 "2020-08-20T15:12:42Z")
```auto
if "$" in [message] { drop { } }
```
Try something like that. If it contains a $ it should drop the message.
---
### Author:  [@davide.stallone](https://discuss.elastic.co/u/davide.stallone)
#### Post date: [August 20, 2020, 3:14pm UTC](https://discuss.elastic.co/t/logstash-filter-drop-message-with-into-string/245784/3 "2020-08-20T15:14:59Z")
Thank you aaron, I tried but it did not works.
---
### Author:  [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [August 20, 2020, 3:21pm UTC](https://discuss.elastic.co/t/logstash-filter-drop-message-with-into-string/245784/4 "2020-08-20T15:21:49Z")
```auto
input {
generator {
lines => [
"aaron.nimocks",
"drop.this$",
"davide.stallone"
]
count => 1
}
}
filter {
if "$" in [message] { drop { } }
}
output {
stdout { codec => "rubydebug" }
}
```
Here is what I ran to test it. It drops the middle record that has a $ in it.
---
### Author:  [@davide.stallone](https://discuss.elastic.co/u/davide.stallone)
#### Post date: [August 20, 2020, 3:25pm UTC](https://discuss.elastic.co/t/logstash-filter-drop-message-with-into-string/245784/5 "2020-08-20T15:25:29Z")
I made new conf file with your code, How can I use it now?
Thx
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [August 20, 2020, 3:26pm UTC](https://discuss.elastic.co/t/logstash-filter-drop-message-with-into-string/245784/6 "2020-08-20T15:26:49Z")
Did you adjust his example for your use case and replace `[message]` with `[user][name]` or did you just take it the way it was?
---
### Author:  [@davide.stallone](https://discuss.elastic.co/u/davide.stallone)
#### Post date: [August 20, 2020, 3:36pm UTC](https://discuss.elastic.co/t/logstash-filter-drop-message-with-into-string/245784/7 "2020-08-20T15:36:21Z")
Hi Jenni,
I also tried your way and the follow ways:
```auto
if ([message] =~ "$") {
mutate {
add_field => { "hello" => "world" }
} "using this one I have added field in all messages"
if ([user.name] =~ "$") {
mutate {
add_field => { "hello" => "world" }
} "the same"
```
the field message contains all data than also contains user.name field.
---
### Author:  [@davide.stallone](https://discuss.elastic.co/u/davide.stallone)
#### Post date: [August 20, 2020, 3:43pm UTC](https://discuss.elastic.co/t/logstash-filter-drop-message-with-into-string/245784/8 "2020-08-20T15:43:14Z")
Ok, I found How to use it
---
### Author:  [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [August 20, 2020, 3:44pm UTC](https://discuss.elastic.co/t/logstash-filter-drop-message-with-into-string/245784/9 "2020-08-20T15:44:08Z")
@davide.stallone glad you got it working! 🙂
---
### Author:  [@davide.stallone](https://discuss.elastic.co/u/davide.stallone)
#### Post date: [August 20, 2020, 3:54pm UTC](https://discuss.elastic.co/t/logstash-filter-drop-message-with-into-string/245784/10 "2020-08-20T15:54:22Z")
Thank you very much!!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 17, 2020, 3:54pm UTC](https://discuss.elastic.co/t/logstash-filter-drop-message-with-into-string/245784/11 "2020-09-17T15:54:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.