Prevent some logs from going to the elastic search

Elastic Stack Elasticsearch
1

I am using Logstash to send logs to the Elastic search. Now I want only the
logs with a particular regex to go to the elastic search and I want the
others to be dropped.

How do I achieve it?

My configuration file is:

input {
file
{
path => "/home/aakash/Desktop/aa.txt"
type => "filetype"
debug=> "true"
}
}
filter {

grok {
type => "filetype"
patterns_dir=>["./patterns"]
pattern => "%{PARSE_ERROR}|%{OTHERS}"
add_tag=>"%{type1},%{type2},%{slave},ERR_SYSTEM,%{fiber1},%{fiber2}"
}

mutate
{
type=>"filetype"
replace => ["@message", "%{message}" ]
replace =>["@timestamp","%{year}-%{monthnum}-%{monthday}T%{hour}:
%{minute}:%{second}.%{_second}Z"]
}

}
output {
stdout { debug => true debug_format => "json"}
elasticsearch
{
}
}

I want the %{OTHERS } to be dropped. How do I modify this code?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

2

This sounds like a question for the Logstash community, not the
Elasticsearch mailing list.

--
Ivan

On Wed, May 15, 2013 at 1:08 AM, Aakash Anuj aakashanuj.iitkgp@gmail.comwrote:

I am using Logstash to send logs to the Elastic search. Now I want only
the logs with a particular regex to go to the Elasticsearch and I want the
others to be dropped.

How do I achieve it?

My configuration file is:

input {
file
{
path => "/home/aakash/Desktop/aa.txt"
type => "filetype"
debug=> "true"
}
}
filter {

grok {
type => "filetype"
patterns_dir=>["./patterns"]
pattern => "%{PARSE_ERROR}|%{OTHERS}"
add_tag=>"%{type1},%{type2},%{slave},ERR_SYSTEM,%{fiber1},%{
fiber2}"
}

mutate
{
type=>"filetype"
replace => ["@message", "%{message}" ]
replace =>["@timestamp","%{year}-%{monthnum}-%{monthday}T%{hour}:
%{minute}:%{second}.%{_second}**Z"]
}

}
output {
stdout { debug => true debug_format => "json"}
elasticsearch
{
}
}

I want the %{OTHERS } to be dropped. How do I modify this code?

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.