# Logstash filter out log lines

**URL:** <https://discuss.elastic.co/t/logstash-filter-out-log-lines/302230>\
**Category:** Logstash\
**Created:** [April 12, 2022, 1:02pm UTC](https://discuss.elastic.co/t/logstash-filter-out-log-lines/302230 "2022-04-12T13:02:46Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![shivendra95](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@shivendra95](https://discuss.elastic.co/u/shivendra95)\
**Post date:** [April 12, 2022, 1:02pm UTC](https://discuss.elastic.co/t/logstash-filter-out-log-lines/302230/1 "2022-04-12T13:02:46Z")

</div>

Hi,  
I have json logs that I want to filter based on the message field.

```auto
{"@timestamp":"2022-04-05T01:20:50.917+00:00","severity":"INFO","service":"service","pid":"18245","thread":"http-nio-8102-exec-1","class":"class","message":"[ELK] some log data"}

```

Above is the json object that is being parsed by logstash, I want to write only those logs onto my Elasticsearch index which have [ELK] in the message field and ignore all other logs.

I'm not able to do this through logstash filters, if anyone can guide me it will of great help.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [April 12, 2022, 1:04pm UTC](https://discuss.elastic.co/t/logstash-filter-out-log-lines/302230/2 "2022-04-12T13:04:48Z")

</div>

You just need a conditional.

```auto
if "[ELK]" not in [message] {
    drop {}
}

```

This will drop every event that does not have the string `"[ELK]"` in the `message` field.

---

<div class="post-metadata">

**Author:** ![shivendra95](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@shivendra95](https://discuss.elastic.co/u/shivendra95)\
**Post date:** [April 12, 2022, 1:08pm UTC](https://discuss.elastic.co/t/logstash-filter-out-log-lines/302230/3 "2022-04-12T13:08:56Z")

</div>

Do I need to add this in the filter section like this

```auto
filter {
json {
if "[ELK]" not in [message] {
    drop {}
}
}

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [April 12, 2022, 1:11pm UTC](https://discuss.elastic.co/t/logstash-filter-out-log-lines/302230/4 "2022-04-12T13:11:44Z")

</div>

It is in the filter section, but it is not inside the `json` filter, you need to put it after you parse the message.

```auto
filter {
    if "[ELK]" not in [message] {
        drop {}
    }
}
```

---

<div class="post-metadata">

**Author:** ![shivendra95](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@shivendra95](https://discuss.elastic.co/u/shivendra95)\
**Post date:** [April 12, 2022, 1:25pm UTC](https://discuss.elastic.co/t/logstash-filter-out-log-lines/302230/5 "2022-04-12T13:25:29Z")

</div>

Thanks for the help. It's now working as I wanted.

---

<div class="post-metadata">

**Author:** ![KALAVATHI\_YALAMANCHA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kalavathi_yalamancha/32/100884_2.png) [@KALAVATHI\_YALAMANCHA](https://discuss.elastic.co/u/KALAVATHI_YALAMANCHA)\
**Post date:** [May 4, 2022, 3:11am UTC](https://discuss.elastic.co/t/logstash-filter-out-log-lines/302230/6 "2022-05-04T03:11:35Z")

</div>

Hi All,

Can somebody please help to check why the below error while using cipher\_kms filter

ipeline error {:pipeline\_id=\>"main", :exception=\>#\<NoMethodError: undefined method `blank' for nil:NilClass>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-cipher_kms-0.1.3/lib/logstash/filters/cipher_kms.rb:234:in `init\_cipher'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-cipher\_kms-0.1.3/lib/logstash/filters/cipher\_kms.rb:131:in `register'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:75:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:232:in `block in register_plugins'", "org/jruby/RubyArray.java:1821:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:231:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:594:in `maybe\_setup\_out\_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:244:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:189:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:141:in `block in start'"], "pipeline.sources"=\>["/usr/share/logstash/pipeline/logstash.conf"], :thread=\>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 1, 2022, 3:11am UTC](https://discuss.elastic.co/t/logstash-filter-out-log-lines/302230/7 "2022-06-01T03:11:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.