# Noob question: Can I use logstash to collect & send specific log lines (not the whole logs)?

**URL:** <https://discuss.elastic.co/t/noob-question-can-i-use-logstash-to-collect-send-specific-log-lines-not-the-whole-logs/160265>\
**Category:** Logstash\
**Created:** [December 11, 2018, 12:25am UTC](https://discuss.elastic.co/t/noob-question-can-i-use-logstash-to-collect-send-specific-log-lines-not-the-whole-logs/160265 "2018-12-11T00:25:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![DaveR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daver/32/38658_2.png) [@DaveR](https://discuss.elastic.co/u/DaveR)\
**Post date:** [December 11, 2018, 12:25am UTC](https://discuss.elastic.co/t/noob-question-can-i-use-logstash-to-collect-send-specific-log-lines-not-the-whole-logs/160265/1 "2018-12-11T00:25:02Z")

</div>

Greetings,

I'd like to collect a set of log _lines_ from remote systems. Does Logstash have this capability, and can the log line specification be configured on the fly?

A bit more detail:  
my product emits _massive_ logs. And, I'd like to know a few discrete things from them. Shipping the entire log is possible but poses other challenges.

To overcome this situation, I'd like to use an agent which can locally monitor logs and based on a specification, forward only specific lines.

And... good lord it would be cool if I could configure specifications centrally (and then the local agents would phone home and pick new configurations).

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [December 11, 2018, 12:54pm UTC](https://discuss.elastic.co/t/noob-question-can-i-use-logstash-to-collect-send-specific-log-lines-not-the-whole-logs/160265/2 "2018-12-11T12:54:11Z")

</div>

I think filebeat has this capability.

Logstash does have a `drop` filter that you can use in a conditional block to "weed" out the lines you don't want.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 8, 2019, 12:54pm UTC](https://discuss.elastic.co/t/noob-question-can-i-use-logstash-to-collect-send-specific-log-lines-not-the-whole-logs/160265/3 "2019-01-08T12:54:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.