# Logstash filter loglevel info warn and error
**URL:** https://discuss.elastic.co/t/logstash-filter-loglevel-info-warn-and-error/299306
**Category:** Logstash
**Created:** [March 10, 2022, 8:50am UTC](https://discuss.elastic.co/t/logstash-filter-loglevel-info-warn-and-error/299306 "2022-03-10T08:50:18Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@waelboss](https://discuss.elastic.co/u/waelboss)
#### Post date: [March 10, 2022, 8:50am UTC](https://discuss.elastic.co/t/logstash-filter-loglevel-info-warn-and-error/299306/1 "2022-03-10T08:50:18Z")
i have this JSON data:
"result": [
```
{
"payload": {
"context": "default",
"level": "DEBUG",
"logger": "org.forgerock.opendj.ldap.CachedConnectionPool",
"message": "Connection attempt failed: availableConnections=0, maxPoolSize=2",
"thread": "LDAP SDK Default Scheduler",
"timestamp": "2022-03-09T07:54:16.939Z",
"transactionId": null
},
"timestamp": "2022-03-09T07:54:16.939328893Z",
"type": "application/json"
}
```
]
i need to index only the data with level (info, warn, error) with logstash, and drop DEBUG one
can someone help ?
---
### Author:  [@casterQ](https://discuss.elastic.co/u/casterQ)
#### Post date: [March 10, 2022, 8:54am UTC](https://discuss.elastic.co/t/logstash-filter-loglevel-info-warn-and-error/299306/2 "2022-03-10T08:54:19Z")
use drop filter
> **[Drop filter plugin | Logstash Reference \[8.1\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-drop.html)**
---
### Author:  [@waelboss](https://discuss.elastic.co/u/waelboss)
#### Post date: [March 10, 2022, 8:55am UTC](https://discuss.elastic.co/t/logstash-filter-loglevel-info-warn-and-error/299306/3 "2022-03-10T08:55:41Z")
i tried it, but it doesn't work
i tried also
if [result][payload][level] == "DEBUG" {
mutate {
remove\_field =\> ["level"] }
}
but it keeps indexing the debug level
---
### Author:  [@casterQ](https://discuss.elastic.co/u/casterQ)
#### Post date: [March 10, 2022, 9:02am UTC](https://discuss.elastic.co/t/logstash-filter-loglevel-info-warn-and-error/299306/4 "2022-03-10T09:02:43Z")
you data in logstash is real JSON or "message::"{{json string}}" now?
---
### Author:  [@casterQ](https://discuss.elastic.co/u/casterQ)
#### Post date: [March 10, 2022, 10:09am UTC](https://discuss.elastic.co/t/logstash-filter-loglevel-info-warn-and-error/299306/5 "2022-03-10T10:09:07Z")
I tested it with follow conf：
```auto
input {
file {
path => "/home/caster/input"
format => json
}
}
filter {
if [loglevel] == "debug" {
drop { }
}
}
output {
file {
path => "/home/caster/output"
}
}
```
when i echo "{"loglevel":"info","id":"1"}" \> input, it write to output
when i echo "{"loglevel":"debug","id":"1"}" \> input, it not write to output
---
### Author:  [@waelboss](https://discuss.elastic.co/u/waelboss)
#### Post date: [March 10, 2022, 10:09am UTC](https://discuss.elastic.co/t/logstash-filter-loglevel-info-warn-and-error/299306/6 "2022-03-10T10:09:38Z")
yes it's json format but the level is not in the message field, it's an independent field
"result": [
```auto
{
"payload": {
"context": "default",
"level": "DEBUG",
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 10, 2022, 3:50pm UTC](https://discuss.elastic.co/t/logstash-filter-loglevel-info-warn-and-error/299306/7 "2022-03-10T15:50:35Z")
> [@waelboss](#):
>
> if [result][payload][level] == "DEBUG" {
[result] appears to be an array. Try
```
if [result][0][payload][level] == "DEBUG" {
```
---
### Author:  [@waelboss](https://discuss.elastic.co/u/waelboss)
#### Post date: [March 12, 2022, 9:23am UTC](https://discuss.elastic.co/t/logstash-filter-loglevel-info-warn-and-error/299306/8 "2022-03-12T09:23:05Z")
indeed it's an array and it works now.
Thank you Badger for your help)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 9, 2022, 9:23am UTC](https://discuss.elastic.co/t/logstash-filter-loglevel-info-warn-and-error/299306/9 "2022-04-09T09:23:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.