# Sampling or filtering varnish logs

**URL:** <https://discuss.elastic.co/t/sampling-or-filtering-varnish-logs/39252>\
**Category:** Logstash\
**Created:** [January 14, 2016, 5:11pm UTC](https://discuss.elastic.co/t/sampling-or-filtering-varnish-logs/39252 "2016-01-14T17:11:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![fchantrel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fchantrel/32/6204_2.png) [@fchantrel](https://discuss.elastic.co/u/fchantrel)\
**Post date:** [January 14, 2016, 5:11pm UTC](https://discuss.elastic.co/t/sampling-or-filtering-varnish-logs/39252/1 "2016-01-14T17:11:56Z")

</div>

Hello,  
I'd like to index a part of my varnish logs to spend less disk space ; is it possible by filtering on a time field or by sampling (perhaps a random in a ruby script ?) ?  
I have two fields with a time : [14/Jan/2016:15:59:34 +0100] or 2016-01-14T14:59:34.839Z  
The best solution would be to index one event per second or per minute but I think it isn't possible.

So I've got two ideas to solve this problem :

- use a random in a ruby filter
- use a filter which filter events on a part of a time field (only if it contains 0 second for example)

Which solution would be the best for you or is there a better way to solve this problem ?

Thanks.  
Frederic.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:15am UTC](https://discuss.elastic.co/t/sampling-or-filtering-varnish-logs/39252/2 "2017-07-06T05:15:41Z")

</div>

Closed on July 6, 2017, 5:15am UTC