# Want to exclude lines in file having "etluser" keyword **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [September 22, 2021, 10:50am UTC](https://discuss.elastic.co/t/want-to-exclude-lines-in-file-having-etluser-keyword/284850 "2021-09-22T10:50:23Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Amit\_Johari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amit_johari/32/94198_2.png) [@Amit\_Johari](https://discuss.elastic.co/u/Amit_Johari)\ **Post date:** [September 22, 2021, 10:50am UTC](https://discuss.elastic.co/t/want-to-exclude-lines-in-file-having-etluser-keyword/284850/1 "2021-09-22T10:50:23Z")
hello team, we want to exclude lines in file having "etluser" keyword. we added this in yml file . Is this correct way to achieve the goal or any other way ? exclude\_lines: ['etluser'] we have multiple filepath added in yml file but all files have same keyword ---
**Author:** ![Amit\_Johari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amit_johari/32/94198_2.png) [@Amit\_Johari](https://discuss.elastic.co/u/Amit_Johari)\ **Post date:** [September 23, 2021, 4:37am UTC](https://discuss.elastic.co/t/want-to-exclude-lines-in-file-having-etluser-keyword/284850/2 "2021-09-23T04:37:25Z")
Any comments please ---
**Author:** ![Amit\_Johari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amit_johari/32/94198_2.png) [@Amit\_Johari](https://discuss.elastic.co/u/Amit_Johari)\ **Post date:** [September 23, 2021, 8:52am UTC](https://discuss.elastic.co/t/want-to-exclude-lines-in-file-having-etluser-keyword/284850/3 "2021-09-23T08:52:37Z")
I tried above option but didnt worked so what we can do now to resolve this. ---
**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\ **Post date:** [September 23, 2021, 9:58am UTC](https://discuss.elastic.co/t/want-to-exclude-lines-in-file-having-etluser-keyword/284850/4 "2021-09-23T09:58:45Z")
That should be the correct way to do it. Can u post an example line that you're trying to exclude? That config option takes regex strings so u may just need to tweak it trip make it match properly. ---
**Author:** ![Amit\_Johari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amit_johari/32/94198_2.png) [@Amit\_Johari](https://discuss.elastic.co/u/Amit_Johari)\ **Post date:** [September 27, 2021, 10:23am UTC](https://discuss.elastic.co/t/want-to-exclude-lines-in-file-having-etluser-keyword/284850/5 "2021-09-27T10:23:51Z")
Sample line: 2021-09-23 12:52:44,592 | INFO | HiveServer2-Handler-Pool: Thread-68096693 | UserName=etluser UserIP=10.117.225.122 Time=2021/09/23 12:52:44 Opertaion=ExecuteStatement stmt={SET hive.exec.dynamic.partition.mode=nonstrict}Result= Detail= | org.apache.hive.service.cli.thrift.ThriftCLIService.logAuditEvent(ThriftCLIService.java:507). We need to exclude all lines where "etluser" is coming ---
**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\ **Post date:** [September 27, 2021, 10:44am UTC](https://discuss.elastic.co/t/want-to-exclude-lines-in-file-having-etluser-keyword/284850/6 "2021-09-27T10:44:40Z")
Try `^.*etluser.*` ---
**Author:** ![Amit\_Johari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amit_johari/32/94198_2.png) [@Amit\_Johari](https://discuss.elastic.co/u/Amit_Johari)\ **Post date:** [September 27, 2021, 10:53am UTC](https://discuss.elastic.co/t/want-to-exclude-lines-in-file-having-etluser-keyword/284850/7 "2021-09-27T10:53:50Z")
> [@legoguy1000](#): > > ^._etluser._ I tried above already but not working ..Still logs are showing in logstash with this keyword. Can we try like this exclude\_lines: ['[e][t][l][u][s][e][r]'] ---
**Author:** ![Amit\_Johari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amit_johari/32/94198_2.png) [@Amit\_Johari](https://discuss.elastic.co/u/Amit_Johari)\ **Post date:** [September 27, 2021, 12:16pm UTC](https://discuss.elastic.co/t/want-to-exclude-lines-in-file-having-etluser-keyword/284850/8 "2021-09-27T12:16:48Z")
We tried both one by one but but not working . exclude\_lines: ['[e][t][l][u][s][e][r]'] exclude\_lines: [^._etluser._] Sample log: 2021-09-27 16:07:47,976 | INFO | HiveServer2-Handler-Pool: Thread-71033208 | OperationId=6849f9d6-e005-4a35-a0f9-d619dfd55a27 UserName=etluser UserIP=10.117.225.126 Time=2021/09/27 16:07:47 Opertaion=ExecuteStatement: stmt={insert into iptv.tx\_iptv\_cms\_channel\_outage partition(yr) select \* , date\_format(current\_timestamp , 'yyyy-MM-dd HH:mm:ss') as load\_timestamp , date\_format(current\_timestamp , 'yyyy') as yr from iptv.iptv\_cms\_channel\_outage\_stg} Result=SUCCESS Detail= | org.apache.hive.service.cli.thrift.ThriftCLIService.logAuditEvent(ThriftCLIService.java:507) ---
**Author:** ![Amit\_Johari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amit_johari/32/94198_2.png) [@Amit\_Johari](https://discuss.elastic.co/u/Amit_Johari)\ **Post date:** [September 29, 2021, 10:09am UTC](https://discuss.elastic.co/t/want-to-exclude-lines-in-file-having-etluser-keyword/284850/9 "2021-09-29T10:09:00Z")
Hello Team, We try above suggestions but not working. We are trying now below approach also to discard event from log file processors: - drop\_event: when: contains: status: "etluser" here I want to know what is the field here we can take in my example instead of status ? ---
**Author:** ![Amit\_Johari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amit_johari/32/94198_2.png) [@Amit\_Johari](https://discuss.elastic.co/u/Amit_Johari)\ **Post date:** [September 29, 2021, 11:55am UTC](https://discuss.elastic.co/t/want-to-exclude-lines-in-file-having-etluser-keyword/284850/10 "2021-09-29T11:55:49Z")
I tried many ways but nothing is working for me processors: - drop\_event: when: contains: message: "etluser" ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 27, 2021, 1:56pm UTC](https://discuss.elastic.co/t/want-to-exclude-lines-in-file-having-etluser-keyword/284850/11 "2021-10-27T13:56:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.