Skip indexing based on field value

[dadoonet (David Pilato)]

That's something you need to fix in the ingest layer.

If you are using logstash, it's easy to call the drop filter.

@magnusbaeck wrote a nice example here:

Creating drop filters based on a string search in a message field

There's nothing wrong with the filter. Perhaps you're not running with the configuration you expect? $ cat test.config input { stdin { } } output { stdout { codec => rubydebug } } filter { if "ASA-6-302013" in [message] { drop{ } } } $ ( echo 'first message' ; echo 'Oct 27 12:43:28 asa10 : %ASA-6-302013: Built inbound TCP connection 1033541997 for outside:10.150.0.0./46742 (10.150.0.0/46742) to inside.customer:172.26.0.0/8080 (161.215.0.0/8080)' ; echo 'third message' ) | /opt/logstash/bin/l…