Specify windows logs

Elastic Stack Logstash
1

Hello,
sorry, but i can't find some answer in the forum about my doubt.

I want to send only error and warning logs to logstash from Windows Server (using nxlog), it's possible filter on logstash? To exclude all is not error, critical or warning?

I try to put the configuration directly on the agent, but without sucessfull.

I'm try to use this configuration: http://serverfault.com/questions/543494/query-specific-logs-from-event-log-using-nxlog

Thanks so much.

2

Yes, you can conditionally drop events in Logstash, e.g. like this:

filter {
  if [level] not in ["error", "critical", "warning"] {
    drop { }
  }
}

This obviously assumes that the loglevel is available in the level field. See https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html for more examples.