# Using the exclude\_lines option

**URL:** <https://discuss.elastic.co/t/using-the-exclude-lines-option/40779>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 2, 2016, 6:47pm UTC](https://discuss.elastic.co/t/using-the-exclude-lines-option/40779 "2016-02-02T18:47:51Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![yammy](https://avatars.discourse-cdn.com/v4/letter/y/9fc29f/32.png) [@yammy](https://discuss.elastic.co/u/yammy)\
**Post date:** [February 2, 2016, 6:47pm UTC](https://discuss.elastic.co/t/using-the-exclude-lines-option/40779/1 "2016-02-02T18:47:51Z")

</div>

According to the [documenation](https://www.elastic.co/guide/en/beats/filebeat/1.1/filebeat-configuration-details.html) I should be able to use the "exclude\_lines" option to filter specific events.

I've setup my filebeat.yml to exclude any entries that start with my load balancer IP, but they still forward to logstash.

```
  paths:
    - /var/log/httpd/access_log
  document_type: apache-access
  exclude_lines: ["^192.168.1.5"]

```

What am I doing wrong?

---

<div class="post-metadata">

**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\
**Post date:** [February 2, 2016, 7:18pm UTC](https://discuss.elastic.co/t/using-the-exclude-lines-option/40779/2 "2016-02-02T19:18:03Z")

</div>

Just to be sure, you are on filebeat 1.1.0, right? The config looks good to me.

---

<div class="post-metadata">

**Author:** ![yammy](https://avatars.discourse-cdn.com/v4/letter/y/9fc29f/32.png) [@yammy](https://discuss.elastic.co/u/yammy)\
**Post date:** [February 2, 2016, 7:36pm UTC](https://discuss.elastic.co/t/using-the-exclude-lines-option/40779/3 "2016-02-02T19:36:34Z")

</div>

Thanks Tudor

I just did a yum repo check and found that it was still on 1.01 and 1.1 was available. Oddly I had checked this earlier to day and it said I was up to date...although I didn't check the version number.

Short answer: yup this was the issue and applying the 1.1 update fixed it.

---

<div class="post-metadata">

**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\
**Post date:** [February 2, 2016, 7:41pm UTC](https://discuss.elastic.co/t/using-the-exclude-lines-option/40779/4 "2016-02-02T19:41:17Z")

</div>

Cool, that's because we just released 1.1 about two hours ago 🙂

> **[Beats 1.1.0 & Winlogbeat released
	  	 | Elastic](https://www.elastic.co/blog/beats-1-1-0-and-winlogbeat-released)**
>
> Today, we announce new versions of the entire Elastic Stack, including a tighter integration of Shield with Kibana and an updated version of ES-Hadoop. Detailed blogs for product releases are ava...

---

<div class="post-metadata">

**Author:** ![yammy](https://avatars.discourse-cdn.com/v4/letter/y/9fc29f/32.png) [@yammy](https://discuss.elastic.co/u/yammy)\
**Post date:** [February 2, 2016, 7:48pm UTC](https://discuss.elastic.co/t/using-the-exclude-lines-option/40779/5 "2016-02-02T19:48:10Z")

</div>

lol, awesome timing then!

---

<div class="post-metadata">

**Author:** ![escvr](https://avatars.discourse-cdn.com/v4/letter/e/77aa72/32.png) [@escvr](https://discuss.elastic.co/u/escvr)\
**Post date:** [July 5, 2016, 10:01am UTC](https://discuss.elastic.co/t/using-the-exclude-lines-option/40779/6 "2016-07-05T10:01:01Z")

</div>

Hi,  
A log file have INFO/DEBUG/ERROR. But i want to exclude debug logs to forward, but still its forwarding.  
Using **filebeat-5.0.0-alpha3**  
exclude\_lines: ["^DEBUG"]

Example json log:  
{"@logdate":"2016-07-05T15:15:50.772+05:30","message":"methodName()","logger\_name":"com.app","thread\_name":"main","level":"DEBUG","fileType":"test"}

is the exclude config correct?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:51pm UTC](https://discuss.elastic.co/t/using-the-exclude-lines-option/40779/7 "2017-07-05T21:51:03Z")

</div>