Search code examples
regexlogginglogstashlogstash-grok

Drop log line containing hash character

In my Logstash shipper I want to filter out lines commented with the hash character:

#This log row should be dropped.
But one this should not.

I was able to use grep filter, but as it is discouraged (going to be decommissioned), I'm trying to get a grok filter to do it instead. This filter is not working:

grok {
  match => ["message", "^#.*"]
  drop_if_match => true
}

I also tried placing the regex in a custom pattern file, but didn't help. Any ideas?

Solution

  • Even simpler, if you're interested:

    filter {
    if ([message] =~ /^#/) {
        drop{}
    }
}

    The last few versions of Logstash have been putting more emphasis on branching logic directly in the config files. Takes a little getting used to, but pretty handy once you do.