# Need help dropping specific messages

**URL:** <https://discuss.elastic.co/t/need-help-dropping-specific-messages/339441>\
**Category:** Logstash\
**Created:** [July 27, 2023, 1:11pm UTC](https://discuss.elastic.co/t/need-help-dropping-specific-messages/339441 "2023-07-27T13:11:28Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![RJC](https://avatars.discourse-cdn.com/v4/letter/r/f14d63/32.png) [@RJC](https://discuss.elastic.co/u/RJC)\
**Post date:** [July 27, 2023, 1:11pm UTC](https://discuss.elastic.co/t/need-help-dropping-specific-messages/339441/1 "2023-07-27T13:11:28Z")

</div>

My logstash server generates the following messages every time it is restarted:

```auto
{"syslog_severity_code":5,"syslog_severity":"notice","syslog_facility_code":1,"message":"\u0000\u0016\u0000\u0014\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001D\u0000\u001E\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u000B\u0000\u0002\u0001\u0000\u0000\r\u0000\"\u0000 \u0004\u0001\b\t\b\u0004\u0004\u0003\b\u0007\u0005\u0001\b","class":"kraken_logstash","@timestamp":"2023-07-27T12:27:02.475837425Z","hostname":"CLAB-LOG02-SVL","host":"10.200.0.52","syslog_facility":"user-level","index":"kraken-syslog","tags":["_grokparsefailure"]}
{"syslog_severity_code":5,"syslog_severity":"notice","syslog_facility_code":1,"message":"\u0000\u0016\u0000\u0014\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001D\u0000\u001E\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u000B\u0000\u0002\u0001\u0000\u0000\r\u0000\"\u0000 \u0004\u0001\b\t\b\u0004\u0004\u0003\b\u0007\u0005\u0001\b","class":"kraken_logstash","@timestamp":"2023-07-27T12:27:02.469455858Z","hostname":"CLAB-LOG02-SVL","host":"10.200.0.52","syslog_facility":"user-level","index":"kraken-syslog","tags":["_grokparsefailure"]}`

```

I want to drop these messages, so I created the following filter:

```auto
filter {
   if "\u000" in [message] { drop {} }
}

```

Well, the filter does not work. I tried various partial string of the messages listed above in if statement (\u0000, u00, \u0016, u0018, etc) but nothing works.

Any idea how to modify drop filter so that it will drop the above messages?

BTW, please disregard grokparsefailure tag in the above messages. If I can drop them, then there will be no grokparsefailure. 🙂

---

<div class="post-metadata">

**Author:** ![widhalmt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/widhalmt/32/8237_2.png) [@widhalmt](https://discuss.elastic.co/u/widhalmt)\
**Post date:** [July 27, 2023, 5:19pm UTC](https://discuss.elastic.co/t/need-help-dropping-specific-messages/339441/2 "2023-07-27T17:19:30Z")

</div>

You could try RegExp matching.

```auto
filter {
  if [message] =~ /\\u000/ { drop {} }
}

```

---

<div class="post-metadata">

**Author:** ![RJC](https://avatars.discourse-cdn.com/v4/letter/r/f14d63/32.png) [@RJC](https://discuss.elastic.co/u/RJC)\
**Post date:** [July 27, 2023, 6:05pm UTC](https://discuss.elastic.co/t/need-help-dropping-specific-messages/339441/3 "2023-07-27T18:05:13Z")

</div>

Thomas,

Thank you very much for your suggestion, but unfortunately it did not solve the problem. The said messages are still not being dropped. ☹

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 27, 2023, 9:18pm UTC](https://discuss.elastic.co/t/need-help-dropping-specific-messages/339441/4 "2023-07-27T21:18:12Z")

</div>

> [@RJC](#):
>
> `if "\u000" in [message] { drop {} }`

I suspect that your message is not a literal "\0000" but a NUL. [This](https://discuss.elastic.co/t/find-and-replace-to-a-unicode-string/252226/2) post might help.

---

<div class="post-metadata">

**Author:** ![RJC](https://avatars.discourse-cdn.com/v4/letter/r/f14d63/32.png) [@RJC](https://discuss.elastic.co/u/RJC)\
**Post date:** [July 28, 2023, 12:31pm UTC](https://discuss.elastic.co/t/need-help-dropping-specific-messages/339441/5 "2023-07-28T12:31:15Z")

</div>

Badger,

Thank you very much for your post. Unfortunately, I have zero knowledge of Ruby. ☹

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 25, 2023, 12:32pm UTC](https://discuss.elastic.co/t/need-help-dropping-specific-messages/339441/6 "2023-08-25T12:32:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.