# Passing only loglevel ERROR FROM LOG USING GROK FILTRATION
**URL:** https://discuss.elastic.co/t/passing-only-loglevel-error-from-log-using-grok-filtration/253369
**Category:** Logstash
**Created:** [October 26, 2020, 10:39pm UTC](https://discuss.elastic.co/t/passing-only-loglevel-error-from-log-using-grok-filtration/253369 "2020-10-26T22:39:50Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@noobman2logstash](https://discuss.elastic.co/u/noobman2logstash)
#### Post date: [October 26, 2020, 10:39pm UTC](https://discuss.elastic.co/t/passing-only-loglevel-error-from-log-using-grok-filtration/253369/1 "2020-10-26T22:39:50Z")
Hi
I'm new to logstash and i need help parsing only error logs when loglevel == error i have tried many filtrations on here and im not getting the result i need.
here is a sample of my error log. i just want to pick any log that contains error on the loglevel as shown below as you can see the message pattern changes thats why i only want to pick only the loglevel error.
172923612 ERROR [WebContainer : 25] uslessattention.nothinghereSODAO 2020-10-17 19:11:12,955 - checkCcEnrollednothing: nothing(s) are enrolled for this manmade but not permissioned for user -
173083431 ERROR [WorkManager.7000\_WM\_lizzard : 5711] uslessattention.nothinghere 2020-10-17 19:13:52,774 - checkCcEnrollednothin: No accounts enrolled for this service -
11473239 ERROR [WebContainer : 4] messagenothinghere.imnotjoiking 2020-10-16 15:22:03,360 - doStartTag(): ~CRITICAL ERROR~ : Please check id headerror =\> [signinId=stress6.test23056@ste.com](mailto:signinId=stress6.test23056@ste.com), nothing=15555555888 -
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 26, 2020, 10:56pm UTC](https://discuss.elastic.co/t/passing-only-loglevel-error-from-log-using-grok-filtration/253369/2 "2020-10-26T22:56:43Z")
You could extract the loglevel using dissect (or grok) or you could pattern match the line
```
if [message] !~ /^\d+ ERROR / { drop {} }
```
---
### Author:  [@noobman2logstash](https://discuss.elastic.co/u/noobman2logstash)
#### Post date: [October 27, 2020, 11:45am UTC](https://discuss.elastic.co/t/passing-only-loglevel-error-from-log-using-grok-filtration/253369/3 "2020-10-27T11:45:08Z")
thanks Badger but doesnt that mean i will have to state all the patterns?
and also this if statement will it be in the output or filtration section?
sorry im asking a silly question this is new to me and im trying to understand it.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 27, 2020, 2:16pm UTC](https://discuss.elastic.co/t/passing-only-loglevel-error-from-log-using-grok-filtration/253369/4 "2020-10-27T14:16:49Z")
> [@noobman2logstash](#):
>
> doesnt that mean i will have to state all the patterns?
No, the filter I showed will drop any message unless it begins with a number and the text ERROR. That would keep all of the messages you showed.
You would add that to the filter section.
---
### Author:  [@noobman2logstash](https://discuss.elastic.co/u/noobman2logstash)
#### Post date: [October 27, 2020, 3:10pm UTC](https://discuss.elastic.co/t/passing-only-loglevel-error-from-log-using-grok-filtration/253369/5 "2020-10-27T15:10:20Z")
thank you so much Badger
so something like this ??
filter {
```
if ([message] !~ /^\d+ ERROR / { drop {} })
mutate
{
add_field => {"appcode" => "7000"}
}
}
output {
elasticspace.......
}
stdout {
codec => rubydebug
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 27, 2020, 3:24pm UTC](https://discuss.elastic.co/t/passing-only-loglevel-error-from-log-using-grok-filtration/253369/6 "2020-10-27T15:24:50Z")
> [@noobman2logstash](#):
>
> `if ([message] !~ /^\d+ ERROR / { drop {} }) `
Yes, but you would need to remove the ( and )
---
### Author:  [@noobman2logstash](https://discuss.elastic.co/u/noobman2logstash)
#### Post date: [October 28, 2020, 12:58pm UTC](https://discuss.elastic.co/t/passing-only-loglevel-error-from-log-using-grok-filtration/253369/7 "2020-10-28T12:58:03Z")
Thanks so much Basger
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 25, 2020, 12:58pm UTC](https://discuss.elastic.co/t/passing-only-loglevel-error-from-log-using-grok-filtration/253369/8 "2020-11-25T12:58:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.