Logstash filter section

Question

Could you please advise how to filter a specific words with Logstash 1.5? For example, it's necessary to filter the following words: Critical, Exit, Not connected. As I remember, in previous versions of Logstash (i.e 1.4 and earlier) it has been possible with grep filter.

Currently my logstash.conf contains:

input {
file {
    path => ["C:\ExportQ\export.log"]
    type => "Exporter-log"
    codec => plain {
        charset => "CP1251"
    }
    start_position => "beginning"
    sincedb_path => "C:\Progra~1\logstash\sincedb"
    }
}

filter {
}

output {
    stdout { codec => rubydebug }
    zabbix {
        zabbix_host => "VS-EXP"
        zabbix_key => "log.exp"
        zabbix_server_host => "192.168.1.71"
        zabbix_value => "message"
    }
}
}

Many thanks in advance!

Answer 1

Use a conditional and the drop filter to delete matching messages.

filter {
  # Simple substring condition
  if "boring" in [message] {
    drop { }
  }

  # Regexp match
  if [message] =~ /boring/ {
    drop { }
  }
}