Use grok to skip seperators lines


(Toto1234) #1

Hello,
I have a log file structured as 2 line separators then the log data ,
I created my parser for the log data , but I don't know how to eliminate those two lines from being proceed through the filter,

please for your help for new starter with elastic , drop didn't work for me ,

.-------------------------------------------.
.-------------------------------------------.
Timestamp: 12/05/2017 XXXXXX
.-------------------------------------------.

Timestamp: 12/05/2017 XXXXXX
.-------------------------------------------.
.-------------------------------------------.


(Christian Dahlqvist) #2

Have you looked into using a mutate filter with a gsub action to simply remove the unwanted characters?


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.