CODEWITHSUNDEEP
logstash
user3715419
user3715419

Reputation: 19

remove certain records in logstash

I'm trying to remove image load urls from the logs when parsing them, but i've tried the below and it doesn't work:

if [message] !~ "*.(jpg|jpeg|gif)" {
  drop {}
}

So for example the below:

[domain]/home/home.do

[domain]/home/home2.do

[domain]/home/image.jpg

[domain]/home/test.do

[domain]/home/image.gif

I want to be filtered down to:

[domain]/home/home.do

[domain]/home/home2.do

[domain]/home/test.do

Thanks

Upvotes: 0

Views: 149

Answers (1)

Val
Val

Reputation: 217564

The correct regular expression looks like this: (+ you need to use =~ instead of !~ since you want to drop images only if they match the regular expression)

if [message] =~ "\.(jpg|jpeg|gif)$" {
    drop {}
}

Upvotes: 2

Related Questions