Output Log Line Containing a Hash Symbol

Question

In my Logstash shipper, I want to filter out lines commented out by a hash symbol:

#This log row should be dropped. But one this should not. 

I managed to use the grep filter, but since it is discouraged (out of service), I am trying to get the grok filter to do this instead. This filter does not work:

 grok { match => ["message", "^#.*"] drop_if_match => true } 

I also tried to place the regex in the user template file, but didn't help. Any ideas?

Answer 1

Even simpler if you're interested:

 filter { if ([message] =~ /^#/) { drop{} } } 

The last few versions of Logstash have paid more attention to branching logic directly in configuration files . A little getting used to, but very convenient as soon as you do it.

Answer 2

Correct answer: error in drop_if_match=>true (Logstash v1.2.2). Use this workaround:

 grok { ... add_tag => ["some_comment"] } if "some_comment" in [tags] { drop {} }