# Remove header from log file **URL:** \ **Category:** Logstash\ **Created:** [June 25, 2018, 11:44am UTC](https://discuss.elastic.co/t/remove-header-from-log-file/137240 "2018-06-25T11:44:07Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![sweta\_khandelwal](https://avatars.discourse-cdn.com/v4/letter/s/c67d28/32.png) [@sweta\_khandelwal](https://discuss.elastic.co/u/sweta_khandelwal)\ **Post date:** [June 25, 2018, 11:44am UTC](https://discuss.elastic.co/t/remove-header-from-log-file/137240/1 "2018-06-25T11:44:08Z")
Hi, Can somebody please check below problem: I have message file in which only one line is there "DateTime,Session,url,errormessage,stacktrace,body". I don't want this line to be indexed in ES. So, I have written below filter pattern in logstash file but it's not working somehow filter{ if [message] =~ /^DateTime/ { drop {} } } It would really be helpful if somebody can tell what I am missing here. Regards, Sweta ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 25, 2018, 11:47am UTC](https://discuss.elastic.co/t/remove-header-from-log-file/137240/2 "2018-06-25T11:47:29Z")
What you have looks fine and should work. If you use a `stdout { codec => rubydebug }` output, what does an event that should've been dropped look like? ---
**Author:** ![sweta\_khandelwal](https://avatars.discourse-cdn.com/v4/letter/s/c67d28/32.png) [@sweta\_khandelwal](https://discuss.elastic.co/u/sweta_khandelwal)\ **Post date:** [June 25, 2018, 12:09pm UTC](https://discuss.elastic.co/t/remove-header-from-log-file/137240/3 "2018-06-25T12:09:21Z")
Can you tell me where to insert the statement you provided in my logstash conf file?? Also, The pattern I have given not working when I am writing it in to logstash conf file. ---
**Author:** ![sweta\_khandelwal](https://avatars.discourse-cdn.com/v4/letter/s/c67d28/32.png) [@sweta\_khandelwal](https://discuss.elastic.co/u/sweta_khandelwal)\ **Post date:** [June 25, 2018, 12:13pm UTC](https://discuss.elastic.co/t/remove-header-from-log-file/137240/4 "2018-06-25T12:13:35Z")
Also Magnus, I want my error file to indexed in ES but there message field should not contain anything. Is this possible? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 25, 2018, 12:26pm UTC](https://discuss.elastic.co/t/remove-header-from-log-file/137240/5 "2018-06-25T12:26:23Z")
> Can you tell me where to insert the statement you provided in my logstash conf file?? In the output block. > Also, The pattern I have given not working when I am writing it in to logstash conf file. Always show - exactly what you've tried and - exactly what happened when you tried that. > I want my error file to indexed in ES but there message field should not contain anything. What error file? If you want to remove the `message` field you can e.g. use a mutate filter. ---
**Author:** ![sweta\_khandelwal](https://avatars.discourse-cdn.com/v4/letter/s/c67d28/32.png) [@sweta\_khandelwal](https://discuss.elastic.co/u/sweta_khandelwal)\ **Post date:** [June 25, 2018, 12:37pm UTC](https://discuss.elastic.co/t/remove-header-from-log-file/137240/6 "2018-06-25T12:37:40Z")
Thanks Magnus for quick replying Error file content which I am trying to filter is as below: DateTime,Session,url,errormessage,stacktrace,body The below is my logstash.conf file input { beats { port =\> 5044 } } filter { if [fields][log\_type] == "errorlogs" { if [message] =~ /^DateTime/ { drop {} } } } output { if [fields][log\_type] == "errorlogs" { elasticsearch { hosts =\> "localhost:9200" manage\_template =\> false index =\> "errorlogs" document\_type =\> "%{[@metadata][type]}" } } } But after executing this, In ES errorlogs indices is not getting created. any idea? Regards, Sweta ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 25, 2018, 1:10pm UTC](https://discuss.elastic.co/t/remove-header-from-log-file/137240/7 "2018-06-25T13:10:23Z")
How do you know that `[fields][log_type]` contains "errorlogs"? ---
**Author:** ![sweta\_khandelwal](https://avatars.discourse-cdn.com/v4/letter/s/c67d28/32.png) [@sweta\_khandelwal](https://discuss.elastic.co/u/sweta_khandelwal)\ **Post date:** [June 25, 2018, 1:41pm UTC](https://discuss.elastic.co/t/remove-header-from-log-file/137240/8 "2018-06-25T13:41:08Z")
I have given it in my filebeat.yml as fields: {log\_type: errorlogs} ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 25, 2018, 1:55pm UTC](https://discuss.elastic.co/t/remove-header-from-log-file/137240/9 "2018-06-25T13:55:24Z")
Sure, but that doesn't prove anything. For example, if `fields_under_root` is true the field will end up as plain `log_type`. You need to challenge all assertions. What does the event _really_ look like? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 23, 2018, 1:55pm UTC](https://discuss.elastic.co/t/remove-header-from-log-file/137240/10 "2018-07-23T13:55:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.