删除包含哈希字符的日志行 [英] Drop log line containing hash character

问题描述

在我的Logstash托运人中，我想过滤出用井号字符注释的行:

In my Logstash shipper I want to filter out lines commented with the hash character:

#This log row should be dropped.
But one this should not.

我能够使用grep过滤器，但是由于不鼓励使用(即将停用)，我正尝试使用grok过滤器来代替它.此过滤器不起作用:

I was able to use grep filter, but as it is discouraged (going to be decommissioned), I'm trying to get a grok filter to do it instead. This filter is not working:

grok {
  match => ["message", "^#.*"]
  drop_if_match => true
}

我也尝试将正则表达式放在自定义模式文件中，但没有帮助.有什么想法吗?

I also tried placing the regex in a custom pattern file, but didn't help. Any ideas?

推荐答案

如果您有兴趣，甚至更简单:

Even simpler, if you're interested:

filter {
    if ([message] =~ /^#/) {
        drop{}
    }
}

Logstash的最后几个版本一直更加注重分支逻辑直接在配置文件中.需要一点时间来适应，但是一旦习惯就会很方便.

The last few versions of Logstash have been putting more emphasis on branching logic directly in the config files. Takes a little getting used to, but pretty handy once you do.

这篇关于删除包含哈希字符的日志行的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！