# Not able to include only required lines from filebeat

**URL:** <https://discuss.elastic.co/t/not-able-to-include-only-required-lines-from-filebeat/138599>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 4, 2018, 5:30pm UTC](https://discuss.elastic.co/t/not-able-to-include-only-required-lines-from-filebeat/138599 "2018-07-04T17:30:40Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![HRG](https://avatars.discourse-cdn.com/v4/letter/h/a4c791/32.png) [@HRG](https://discuss.elastic.co/u/HRG)\
**Post date:** [July 4, 2018, 5:30pm UTC](https://discuss.elastic.co/t/not-able-to-include-only-required-lines-from-filebeat/138599/1 "2018-07-04T17:30:40Z")

</div>

Filebeat experts:

I have gone through some existing forms topics to resolve the issue but i could not achieve it. From my log file, i wanted to extract only those line which has "Pub File" and "Published". I have provided below. I observed, it is extracting all the files from the log file. Can you please help what is missing in the filebeat.yml.

include\_lines: ['Pub File', 'Published']

---

<div class="post-metadata">

**Author:** ![HRG](https://avatars.discourse-cdn.com/v4/letter/h/a4c791/32.png) [@HRG](https://discuss.elastic.co/u/HRG)\
**Post date:** [July 4, 2018, 8:17pm UTC](https://discuss.elastic.co/t/not-able-to-include-only-required-lines-from-filebeat/138599/2 "2018-07-04T20:17:14Z")

</div>

Further info, Even though the lines are matching with below, it is sending all the lines to target.

include\_lines: ['^._Pub File._']

Somehow the \* is not showing in the post i.e i have \* after the .

Any thoughts?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 1, 2018, 8:17pm UTC](https://discuss.elastic.co/t/not-able-to-include-only-required-lines-from-filebeat/138599/3 "2018-08-01T20:17:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
