# Remove a value in grok filter

**URL:** <https://discuss.elastic.co/t/remove-a-value-in-grok-filter/26943>\
**Category:** Logstash\
**Created:** [August 6, 2015, 6:31am UTC](https://discuss.elastic.co/t/remove-a-value-in-grok-filter/26943 "2015-08-06T06:31:48Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bharath\_Paruchuri](https://avatars.discourse-cdn.com/v4/letter/b/43a26b/32.png) [@Bharath\_Paruchuri](https://discuss.elastic.co/u/Bharath_Paruchuri)\
**Post date:** [August 6, 2015, 6:31am UTC](https://discuss.elastic.co/t/remove-a-value-in-grok-filter/26943/1 "2015-08-06T06:31:48Z")

</div>

Hi All,

I have Prepared Logstash configuration code

filter {  
multiline {  
pattern =\> "^####"  
negate =\> true  
what =\> "previous"  
}

```
grok {
pattern => ["####<%{DATA:Timestamp}> <%{WORD:Severity}> %{GREEDYDATA:LogMessage}"]

```

}

To analyse log file content like below.

####\<Jul 26, 2015 12:02:00 AM EDT\> \<eag\_dfg\> \<[ACTIVE] ExecuteThread: '14' for queue: 'weblogic.kernel.Default (self-tuning)'\> \<\> a80c994595c9e109:-2a0044f6:14ea45c3fe1:-8000-000000000000ae03 \<1437883320375\>   
####\<Jul 26, 2015 12:02:00 AM EDT\> \<eag\_dfg\> \<[ACTIVE] ExecuteThread: '14' for queue: 'weblogic.kernel.Default (self-tuning)'\> \<\> a80c994595c9e109:-2a0044f6:14ea45c3fe1:-8000-000000000000ae03 \<1437883320409\>   
####\<Jul 26, 2015 12:02:00 AM EDT\> \<eag\_dfg\> \<DynamicListenThread[Default[2]]\> \<\> \<\> a80c994595c9e109:-2a0044f6:14ea45c3fe1:-8000-0000000000000006 \<1437883320416\> \<Channel "Default[2]" listening on 127.0.0.1:7045 was shutdown.\>

It is working as excepted.

I prepared a filter code like, 2nd field in log lines is storing in Severity column of Logstash.

Now i'm trying to remove log lines, when ever the value for Severity= Info.

I tried below. But it didn't work.

ruby {  
code =\> "event.to\_hash.delete\_if {|Severity, value| value == 'Info' }"  
}

Please assist me.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 6, 2015, 5:43pm UTC](https://discuss.elastic.co/t/remove-a-value-in-grok-filter/26943/2 "2015-08-06T17:43:37Z")

</div>

```
filter {
  if [Severity] == "Info" {
    drop { }
  }
}
```

---

<div class="post-metadata">

**Author:** ![Bharath\_Paruchuri](https://avatars.discourse-cdn.com/v4/letter/b/43a26b/32.png) [@Bharath\_Paruchuri](https://discuss.elastic.co/u/Bharath_Paruchuri)\
**Post date:** [September 18, 2015, 1:53pm UTC](https://discuss.elastic.co/t/remove-a-value-in-grok-filter/26943/3 "2015-09-18T13:53:24Z")

</div>

Thank you. That helped me.

Now similarly i have been trying to remove

LogMessage Filed contains data like :

Tried with below code . It didn't work.

if [LogMessage] == ""  
{  
drop { }  
}

Could you please assist me on this.

Regards,  
Bharath

---

<div class="post-metadata">

**Author:** ![Bharath\_Paruchuri](https://avatars.discourse-cdn.com/v4/letter/b/43a26b/32.png) [@Bharath\_Paruchuri](https://discuss.elastic.co/u/Bharath_Paruchuri)\
**Post date:** [September 18, 2015, 1:54pm UTC](https://discuss.elastic.co/t/remove-a-value-in-grok-filter/26943/4 "2015-09-18T13:54:41Z")

</div>

Above reply Missed some data..

Now similarly i have been trying to remove

LogMessage Filed contains data like : Enququeing to Error hospital...  
Enququeing to Error hospital successful...

Tried with below code . It didn't work.

if [LogMessage] == "Enququeing to Error hospital successful..."  
{  
drop { }  
}

Could you please assist me on this.

Regards,  
Bharath

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 18, 2015, 1:57pm UTC](https://discuss.elastic.co/t/remove-a-value-in-grok-filter/26943/5 "2015-09-18T13:57:39Z")

</div>

(I'm pretty sure you can edit old posts if you need to correct something.)

There's no structural problem with that configuration snippet. I suspect the `LogMessage` field simply isn't equal to _exactly_ "Enququeing to Error hospital successful...".

If you can supply a minimal example that exhibits the problem it would be easier to help.

---

<div class="post-metadata">

**Author:** ![Bharath\_Paruchuri](https://avatars.discourse-cdn.com/v4/letter/b/43a26b/32.png) [@Bharath\_Paruchuri](https://discuss.elastic.co/u/Bharath_Paruchuri)\
**Post date:** [September 18, 2015, 4:48pm UTC](https://discuss.elastic.co/t/remove-a-value-in-grok-filter/26943/6 "2015-09-18T16:48:11Z")

</div>

Thank you.

I made changes in main pattern filter. Then i tried the code. It worked.

Thanks for your valuable suggestion.

---

<div class="post-metadata">

**Author:** ![Bharath\_Paruchuri](https://avatars.discourse-cdn.com/v4/letter/b/43a26b/32.png) [@Bharath\_Paruchuri](https://discuss.elastic.co/u/Bharath_Paruchuri)\
**Post date:** [September 21, 2015, 11:49am UTC](https://discuss.elastic.co/t/remove-a-value-in-grok-filter/26943/7 "2015-09-21T11:49:31Z")

</div>

Hi,

I'm trying to remove LogMessage field contains output like

[43144] Skipping execution of Initialization Block: 'LAST\_SYND\_DS\_YTD\_QTD'  
[43144] Skipping execution of Initialization Block: 'LAST\_SYND\_IDS\_YTD\_QTD'  
[43144] Skipping execution of Initialization Block: 'LAST\_SYND\_RX\_YTD\_QTD'

All lines contains [43144] as common. So tried below to remove those lines. But it didn't work.

if [LogMessage] in [43144]  
{  
drop { }  
}

Is there a way to compare part of string in if condition ?

Please assist.

Regards,  
Bharath'

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 21, 2015, 12:34pm UTC](https://discuss.elastic.co/t/remove-a-value-in-grok-filter/26943/8 "2015-09-21T12:34:55Z")

</div>

```
if "[43144]" in [LogMessage] {
  drop { }
}
```

---

<div class="post-metadata">

**Author:** ![Bharath\_Paruchuri](https://avatars.discourse-cdn.com/v4/letter/b/43a26b/32.png) [@Bharath\_Paruchuri](https://discuss.elastic.co/u/Bharath_Paruchuri)\
**Post date:** [September 21, 2015, 1:18pm UTC](https://discuss.elastic.co/t/remove-a-value-in-grok-filter/26943/9 "2015-09-21T13:18:47Z")

</div>

Thank you.

It worked.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:28am UTC](https://discuss.elastic.co/t/remove-a-value-in-grok-filter/26943/10 "2017-07-06T05:28:32Z")

</div>