# Logstash not dropping messages as configured
**URL:** https://discuss.elastic.co/t/logstash-not-dropping-messages-as-configured/170554
**Category:** Logstash
**Created:** [March 1, 2019, 7:42pm UTC](https://discuss.elastic.co/t/logstash-not-dropping-messages-as-configured/170554 "2019-03-01T19:42:44Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@LollerAgent](https://discuss.elastic.co/u/LollerAgent)
#### Post date: [March 1, 2019, 7:42pm UTC](https://discuss.elastic.co/t/logstash-not-dropping-messages-as-configured/170554/1 "2019-03-01T19:42:44Z")
Can someone please help me understand why the following "drop" filter is not working?
As you can see, the original [message] field is in [json][log][message] but is renamed to [log][message] in the second filter. I have confirmed (by using debug) that Logstash does indeed see the "message" as [log][message], but the filter to drop the message is not working.
```
if [json] {
mutate {
id => "filter-move-object-to-log"
rename => { "[json]" => "[log]" }
}
}
if [log][message] =~ /The client method is deprecated as of redis-rb 4.0.0, please use the new _clientmethod instead/ {
drop {
id => "filter-drop-redis-dep-notice"
}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 1, 2019, 7:57pm UTC](https://discuss.elastic.co/t/logstash-not-dropping-messages-as-configured/170554/2 "2019-03-01T19:57:20Z")
If the message field starts off in [json][log][message] then that rename would move it to [log][log][message], not [log][message]
---
### Author:  [@LollerAgent](https://discuss.elastic.co/u/LollerAgent)
#### Post date: [March 1, 2019, 9:39pm UTC](https://discuss.elastic.co/t/logstash-not-dropping-messages-as-configured/170554/3 "2019-03-01T21:39:51Z")
Isn't it a bit odd then that a debug output in Logstash shows it at [log][message]?
```
{
"@timestamp" => 2019-03-01T18:52:02.918Z,
"input" => {
"type" => "docker"
},
"log" => {
"amazon_trace_id" => "123",
"pid" => 27,
"custom_fields" => {},
"level" => "info",
"log_weasel_trace_id" => "123",
"message" => "The client method is deprecated as of redis-rb 4.0.0, please use the new _clientmethod instead",
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 1, 2019, 9:49pm UTC](https://discuss.elastic.co/t/logstash-not-dropping-messages-as-configured/170554/4 "2019-03-01T21:49:57Z")
> [@LollerAgent](#):
>
> Isn't it a bit odd then that a debug output in Logstash shows it at [log][message]?
Seems odd to me.
---
### Author:  [@LollerAgent](https://discuss.elastic.co/u/LollerAgent)
#### Post date: [March 4, 2019, 2:36pm UTC](https://discuss.elastic.co/t/logstash-not-dropping-messages-as-configured/170554/5 "2019-03-04T14:36:37Z")
Does anyone else here have any ideas? Verified that [log][log][message] doesn't work either:
```
{
"id" : "filter-drop-redis-dep-notice",
"events" : {
"duration_in_millis" : 0,
"in" : 0,
"out" : 0
},
```
---
### Author:  [@LollerAgent](https://discuss.elastic.co/u/LollerAgent)
#### Post date: [March 4, 2019, 2:58pm UTC](https://discuss.elastic.co/t/logstash-not-dropping-messages-as-configured/170554/6 "2019-03-04T14:58:31Z")
UPDATE. This config works:
```
if [message] =~ /The client method is deprecated as of redis-rb 4.0.0, please use the new _clientmethod instead/ {
drop {
id => "filter-drop-redis-dep-notice"
}
}
```
So, even though Logstash debug shows the field at [log][message], the rule only succeeds if I specify [message]. Can someone help me understand why?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 1, 2019, 2:58pm UTC](https://discuss.elastic.co/t/logstash-not-dropping-messages-as-configured/170554/7 "2019-04-01T14:58:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.