CODEWITHSUNDEEP
logstash
lorem
lorem

Reputation: 1199

logstash filter drop if headers is a specific value

I am using the logstash http input plugin. I want to filter and drop if the user_agent is a specific value.

{
  "_index": "some-logs-prod-2017.09.21",
  "_type": "logs",
  "_id": "AV6kDXSxKY2mOqXynuEV",
  "_score": null,
  "_source": {
    "message": "",
    "@version": "1",
    "@timestamp": "2017-09-21T10:48:12.541Z",
    "host": "172.31.43.24",
    "headers": {
      "request_method": "GET",
      "request_path": "/",
      "request_uri": "/",
      "http_version": "HTTP/1.1",
      "http_host": "172.31.33.62:33067",
      "http_connection": "close",
      "http_user_agent": "ELB-HealthChecker/2.0",
      "http_accept_encoding": "gzip, compressed"
    }
  },
  "fields": {
    "@timestamp": [
      1505990892541
    ]
  },
  "highlight": {
    "headers.http_user_agent": [
      "@kibana-highlighted-field@ELB@/kibana-highlighted-field@-@kibana-highlighted-field@HealthChecker@/kibana-highlighted-field@/2.0"
    ]
  },
  "sort": [
    1505990892541
  ]
}

In this case, I want to drop the message when http_user_agent == ELB-HealthChecker How do I go about doing that?

Upvotes: 1

Views: 678

Answers (1)

lorem
lorem

Reputation: 1199

I had to use [headers][http_user_agent], thanks to baudsp.

Upvotes: 1

Related Questions