Prevent logs from appearing in Kibana

Elastic Stack Logstash
1

Good Morning.

I am a novice in ELK stack. I have problems in my logstash . I get many logs, but I need to keep a log with a specific message to appear on Kibana . How can I keep a log appear in Kibana for your message ?

For example , I need to remove the log that contains the following words : pppoe , ppp .

How do I do that?

2

Do you want to

  • store the PPP-related events in Elasticsearch but not display them in Kibana, or
  • not store the events in Elasticsearch at all, in other words have Logstash just drop the events?
3

PPP logs are not useful to me in logstash . I am using the elk stack to manage logs of my MikroTik routers, and I'm having a lot of trouble . From the mikrotik get multiple logs , already are all going to Kibana , but now I just need to keep the logs of type PPP , PPPoE are stored in the database . Except that all the logs comes as a message, such as:

message: pppoe,ppp,info : connected @version:1 @timestamp:August 25th 2016, 11:01:14.990 type:syslog host:177.124.72.4 _id:AVbCATgFx-cjIMIocgLZ _type:syslog _index:logstash-2016.08.25 _score:

This is the log I get the data with PPP , PPPoE ..

Now the example of another log (the log want to keep it ) :slight_smile:

message:system,error,critical login failure for user ftp from 208.100.26.232 via ftp @version:1 @timestamp:August 25th 2016, 09:31:05.326 type:syslog host:177.124.72.12 _id:AVbBrrASx-cjIMIocfYi _type:syslog _index:logstash-2016.08.25 _score:

In short , I want to prevent the PPP , PPPoE logs, and other logs do not .

Sorry for the bad language , can not speak and read English.

4

The drop filter can help:

if "ppp" in [message] {
  drop { }
}
5

Worked, thank you !

6

I would like to store events in Elasticsearch and aggregate on them but they are not imprtant for debugging because it actually shows too many unnecessary logs.
This slows down the process because it spams you and it is harder to look for the exact log you look for.

How would I just kinda pushed these log lines in the backwards?

7

@Nejc_Zupan, please start a new thread for your unrelated question.