8

In my Logstash shipper I want to filter out lines commented with the hash character:

#This log row should be dropped.
But one this should not.

I was able to use grep filter, but as it is discouraged (going to be decommissioned), I'm trying to get a grok filter to do it instead. This filter is not working:

grok {
  match => ["message", "^#.*"]
  drop_if_match => true
}

I also tried placing the regex in a custom pattern file, but didn't help. Any ideas?

2 Answers 2

21

Even simpler, if you're interested:

filter {
    if ([message] =~ /^#/) {
        drop{}
    }
}

The last few versions of Logstash have been putting more emphasis on branching logic directly in the config files. Takes a little getting used to, but pretty handy once you do.

1
  • 1
    You don't need extra () around the if condition. if [message =~ "^#"] { is now sufficient.
    – jmcollin92
    Apr 5, 2016 at 12:39
2

The correct answer is that there is a bug in drop_if_match=>true (Logstash v1.2.2). Use this type of workaround:

grok {
  ...
  add_tag => ["some_comment"]
}
if "some_comment" in [tags] {
  drop {}
}
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.