# Using Logstash, not able to filter Error Level while indexing to elastic search

**URL:** https://discuss.elastic.co/t/using-logstash-not-able-to-filter-error-level-while-indexing-to-elastic-search/240916
**Category:** Logstash
**Created:** [July 13, 2020, 7:47am UTC](https://discuss.elastic.co/t/using-logstash-not-able-to-filter-error-level-while-indexing-to-elastic-search/240916 "2020-07-13T07:47:42Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Rakesh\_Katakam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rakesh_katakam/32/47247_2.png) [@Rakesh\_Katakam](https://discuss.elastic.co/u/Rakesh_Katakam)
#### Post date: [July 13, 2020, 7:47am UTC](https://discuss.elastic.co/t/using-logstash-not-able-to-filter-error-level-while-indexing-to-elastic-search/240916/1 "2020-07-13T07:47:42Z")

</div>

Hi,

I recently started using ELK stack and we came across a scenario where to filter Error level logs in application log files and want to push Elastic search to do more visualization on logs using Kibana.

Here below is the Event pipeline which we have written to extract logs and push to elastic search.

```auto
input {
   file {
      path => "D:/obe.log"
	  codec => multiline {
      pattern => "<%{LOGLEVEL:log-level}>%{SPACE}<%{TIMESTAMP_ISO8601:timestamp}>%{SPACE}<%{NUMBER:PID}>%{SPACE}<%{GREEDYDATA:processName}>%{SPACE}<%{JAVACLASS:class}>%{SPACE}<%{JAVALOGMESSAGE:logmessage}>"
      negate => true
      what => "previous"
    }
   }
}
output {
	if [log-level] == "ERROR" {
		elasticsearch {
			hosts => ["127.0.0.1:9200"]
			index => "errors"
		}
		stdout {}	
	}	
}

```

In output plugin, with out if condition, I observed all logs got indexed to elastic search which is working as expected, but by adding if [log-level] == "ERROR", I don't see any events getting indexed.

Could you please suggest if there is any mistake in the configuration which I have shown above (or) if there is any other way..

Thanks,  
Rakesh.

---

<div class="post-metadata">

### Author: ![Rakesh\_Katakam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rakesh_katakam/32/47247_2.png) [@Rakesh\_Katakam](https://discuss.elastic.co/u/Rakesh_Katakam)
#### Post date: [July 13, 2020, 1:38pm UTC](https://discuss.elastic.co/t/using-logstash-not-able-to-filter-error-level-while-indexing-to-elastic-search/240916/2 "2020-07-13T13:38:21Z")

</div>

It got resolved by doing configuration in below way..

```auto

input {
   file {
      path => "D:/obe.log"
	  codec => multiline {
      pattern => "^<%{LOGLEVEL:log-level}>"
      negate => true
      what => "previous"
    }
   }
}
filter{
    grok{
        match => {"message" => "<%{LOGLEVEL:log-level}>%{SPACE}<%{TIMESTAMP_ISO8601:timestamp}>%{SPACE}<%{NUMBER:PID}>%{SPACE}<%{GREEDYDATA:processName}>%{SPACE}<%{JAVACLASS:class}>%{SPACE}<%{JAVALOGMESSAGE:logmessage}>"}
    }
}	
output {
	if [log-level] == "ERROR" {
		elasticsearch {
			hosts => ["127.0.0.1:9200"]
			index => "errors"
		}
		stdout {}	
	}	
}

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 10, 2020, 1:45pm UTC](https://discuss.elastic.co/t/using-logstash-not-able-to-filter-error-level-while-indexing-to-elastic-search/240916/3 "2020-08-10T13:45:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.