I've started using ELK yesterday, moving from logcheck and I would like to re-use the ignore rules of logcheck and some custom I had added. I currently have two servers providing logs throught filebeat to logstash, who then passes them on to elasticsearch and kibana.
I see two ways of doing this, either by filtering the logs before giving them to elasticsearch (or kibana?*) or by somehow enable a data view of some sort which doesn't include the ignored lines on searches and so on.
I've seen that logstash has grep filters, could you point me to a good tutorial on how to use it? And maybe give your 5 cents on the proper way to do this.
What would you recommend?
*I am a newbie here, I am still illiterate about who is supposed to do what, not to say the proper terminology.