Regex matching expression to exclude line

Hey!

I want to exclude a line with filebeat, that is the following:

(ERROR) Can't find TpTag 'TagUid' in TpPin

Anyone knows how to match that full line with regular expressions? Those apostrophes aren't letting me start filebeat...

The following worked for me on filebeat 6.0.0

Input file - bla.log

(ERROR) Can't find TpTag 'TagUid' in TpPin
(INFO) Can't find TpTag 'TagUid' in TpPin
(INFO) The quick brown fox jumps over the lazy dog
This one will be rightfully ignored (ERROR) Can't find TpTag 'TagUid' in TpPin

filebeat config

filebeat.prospectors:
- type: log
  exclude_lines: [^\(ERROR\) Can\'t find TpTag \'TagUid\' in TpPin$]
  paths:
   - "C:/dev/elk_test_env/test/bla.log"
output.logstash:
  hosts: ["localhost:5080"]

As mentioned in Regular expression support | Filebeat Reference [8.11] | Elastic

The single quotation marks are recommended but not necessary.

Yeah, thanks, it also worked for me... I really didn't need the single quotes on the exclude line configuration!
The one thing I didn't try... Thanks!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.