Logstash filter not working

Elastic Stack Logstash
1

I have filebeat, logstash and elasticsearch. My logstash config.d looks like this

logstashconfig

02-beats-input.conf receives the message from filebeat
30-elasticsearch-output.conf sends to elasticsearch ingest pipeline. Logstash doesn't do any parsing.
I am trying to implement filters for the various logs but they don't seem to be working.
The 12-system.syslog-filter.conf is like this

syslogfilter
syslogfilter1053×766 104 KB

I have tried several iterations and snippets from others but I am still getting the messages that I expect to be filtered shown in my Kibana search.

Sorry, I can't post actual code as the system is in a secure environment with no copy out so that is why screenshots

2

It's working for me if test with if ("Created slice" in [message]) { ... on the latest LS version.

Have you tried with?
if ([message] =~ /\ACreated slice/ ) { drop {} }

Are you sure that both IFs are working? [event][module] and [fileset][name] ?

3

One more thing, check are nested fields or with dots. For instance, "event": { "modules": "system" } might be: "event.modules": "system". You will see it in Kibana - JSON view.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.