Regex matching expression to exclude line


(Miguel Leite) #1

Hey!

I want to exclude a line with filebeat, that is the following:

(ERROR) Can't find TpTag 'TagUid' in TpPin

Anyone knows how to match that full line with regular expressions? Those apostrophes aren't letting me start filebeat...


#2

The following worked for me on filebeat 6.0.0

Input file - bla.log

(ERROR) Can't find TpTag 'TagUid' in TpPin
(INFO) Can't find TpTag 'TagUid' in TpPin
(INFO) The quick brown fox jumps over the lazy dog
This one will be rightfully ignored (ERROR) Can't find TpTag 'TagUid' in TpPin

filebeat config

filebeat.prospectors:
- type: log
  exclude_lines: [^\(ERROR\) Can\'t find TpTag \'TagUid\' in TpPin$]
  paths:
   - "C:/dev/elk_test_env/test/bla.log"
output.logstash:
  hosts: ["localhost:5080"]

As mentioned in https://www.elastic.co/guide/en/beats/filebeat/current/regexp-support.html

The single quotation marks are recommended but not necessary.


(Miguel Leite) #3

Yeah, thanks, it also worked for me... I really didn't need the single quotes on the exclude line configuration!
The one thing I didn't try... Thanks!