# Parsing lines that only match a start string

**URL:** https://discuss.elastic.co/t/parsing-lines-that-only-match-a-start-string/215125
**Category:** Logstash
**Created:** [January 15, 2020, 11:38am UTC](https://discuss.elastic.co/t/parsing-lines-that-only-match-a-start-string/215125 "2020-01-15T11:38:23Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![whoatemyjam](https://avatars.discourse-cdn.com/v4/letter/w/5f9b8f/32.png) [@whoatemyjam](https://discuss.elastic.co/u/whoatemyjam)
#### Post date: [January 15, 2020, 11:38am UTC](https://discuss.elastic.co/t/parsing-lines-that-only-match-a-start-string/215125/1 "2020-01-15T11:38:23Z")

</div>

hi  
Please if you can help.  
How can we get logstash to log only the lines starting with "central-logging": "true" and ignore rest which we dont need.

{ "central-logging": "true", "log-date": "2020-01-15 11:19:08 UTC", "severity": "INFO", "BuildSetID": "sim-12345678", "Process": "CheckJobInputs", "log-message": "Directory: /images exists"}

---

<div class="post-metadata">

### Author: ![andres-perez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andres-perez/32/136461_2.png) [@andres-perez](https://discuss.elastic.co/u/andres-perez)
#### Post date: [January 15, 2020, 2:08pm UTC](https://discuss.elastic.co/t/parsing-lines-that-only-match-a-start-string/215125/2 "2020-01-15T14:08:18Z")

</div>

> [@whoatemyjam](#):
>
> log only the lines starting with "central-logging": "true" and ignore rest

If by ignore you mean "discard all other events and not even index them", you can start your filter with a condition to `drop` the messages that won't match a regexp `!~` looking for log contents that start with `^` your desired string. The curly bracket must be escaped `\{`.

That is:

```
  if [message] !~ /^\{ "central-logging": "true"/ {
    drop { } 
  }

```

Having said that, if you may want to process the other lines in the future, it may be worth taking a look at the [json filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-json.html) and set conditions depending on the existence or value of "central-logging".

---

<div class="post-metadata">

### Author: ![whoatemyjam](https://avatars.discourse-cdn.com/v4/letter/w/5f9b8f/32.png) [@whoatemyjam](https://discuss.elastic.co/u/whoatemyjam)
#### Post date: [January 21, 2020, 3:11pm UTC](https://discuss.elastic.co/t/parsing-lines-that-only-match-a-start-string/215125/3 "2020-01-21T15:11:41Z")

</div>

Hi Andres  
I have a huge log and i just want to print the line that matches with { "central-logging": "true", withing the message

Thanks

---

<div class="post-metadata">

### Author: ![andres-perez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andres-perez/32/136461_2.png) [@andres-perez](https://discuss.elastic.co/u/andres-perez)
#### Post date: [January 27, 2020, 9:57am UTC](https://discuss.elastic.co/t/parsing-lines-that-only-match-a-start-string/215125/4 "2020-01-27T09:57:59Z")

</div>

So, either you discard all the other messages (as I have described in my previous comment) or you add a condition in the output section to log only the messages that match `=~` your string.

You can see examples in the documentation: [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 24, 2020, 9:58am UTC](https://discuss.elastic.co/t/parsing-lines-that-only-match-a-start-string/215125/5 "2020-02-24T09:58:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
