The following worked for me on filebeat 6.0.0
Input file - bla.log
(ERROR) Can't find TpTag 'TagUid' in TpPin
(INFO) Can't find TpTag 'TagUid' in TpPin
(INFO) The quick brown fox jumps over the lazy dog
This one will be rightfully ignored (ERROR) Can't find TpTag 'TagUid' in TpPin
filebeat config
filebeat.prospectors:
- type: log
exclude_lines: [^\(ERROR\) Can\'t find TpTag \'TagUid\' in TpPin$]
paths:
- "C:/dev/elk_test_env/test/bla.log"
output.logstash:
hosts: ["localhost:5080"]
As mentioned in Regular expression support | Beats
The single quotation marks are recommended but not necessary.