CODEWITHSUNDEEP
logginglogstashconfig
August Gerro
August Gerro

Reputation: 103

How to drop by filter input logs in logstash

I want to filter my incoming messages. I don`t want receive messages, which contains next regexp:

\*sshd\*|\*k8s_kube\-proxy\*|\*k8s_kube\-proxy\*|worker|\-proxy|k8s_influxdb|\*sshd\*|\*k8s_kube\-proxy\*|\*k8s_kube\-proxy\*|worker|\-proxy|k8s_influxdb|200\ POST|200\ GET|GET\ 200|GET\ /status\ HTTP/1\.1

How to write logstash config properly?

Upvotes: 1

Views: 133

Answers (1)

Alcanzar
Alcanzar

Reputation: 17155

There is an if construct that takes a regular expression and a drop filter to get rid of events.

Putting that together:

filter {
  if ([message] =~ /YOUR_REGEX_HERE/) {
    drop {}
  }
}

Upvotes: 1

Related Questions