how to exclude logs/events in journalbeat

user_5761011 0
Viewed 939

We are using journalbeat to push logs of kubernetes cluster to elastic search. It working fine and pushing the logs. However its also pushing event like "200 OK" and "INFO" which we do not want. The journalbeat.yaml is as follows

journalbeat.yaml

  journalbeat.yml: |
    name: "${NODENAME}"
    journalbeat.inputs:
    - paths: []
      seek: cursor
      cursor_seek_fallback: tail

    processors:
    - add_kubernetes_metadata:
        host: "${NODENAME}"
        in_cluster: true
        default_indexers.enabled: false
        default_matchers.enabled: false
        indexers:
          - container:
        matchers:
          - fields:
              lookup_fields: ["container.id"]
    - decode_json_fields:
        fields: ["message"]
        process_array: false
        max_depth: 1
        target: ""
        overwrite_keys: true
    - drop_event.when:
        or:
        - regexp.kubernetes.pod.name: "filebeat-.*"
        - regexp.kubernetes.pod.name: "journalbeat-.*"
        - regexp.kubernetes.pod.name: "nginx-ingress-controller-.*"
        - regexp.kubernetes.pod.name: "prometheus-operator-.*"

    setup.template.enabled: false
    setup.template.name: "journal-${ENVIRONMENT}-%{[agent.version]}"
    setup.template.pattern: "journal-${ENVIRONMENT}-%{[agent.version]}-*"
    setup.template.settings:
      index.number_of_shards: 10
      index.refresh_interval: 10s

    output.elasticsearch:
      hosts: '${ELASTICSEARCH_HOSTS:elasticsearch:9200}'
      username: '${ELASTICSEARCH_USERNAME}'
      password: '${ELASTICSEARCH_PASSWORD}'
      index: "journal-${ENVIRONMENT}-system-%{[agent.version]}-%{+YYYY.MM.dd}"
      indices:
      - index: "journal-${ENVIRONMENT}-k8s-%{[agent.version]}-%{+YYYY.MM.dd}"
        when.has_fields:
        - 'kubernetes.namespace'

How can i exclude logs like "INFO" and "200 OK" events?

typhoon-kubernetes elasticsearch kubernetes logging
2 Answers

As far as I'm aware there is no way to exclude logs in Journalbeat. It's working other way around, meaning you tell it what input to look for. You should read about Configuration input:

By default, Journalbeat reads log events from the default systemd journals. To specify other journal files, set the paths option in the journalbeat.inputs section of the journalbeat.yml file. Each path can be a directory path (to collect events from all journals in a directory), or a file path.

journalbeat.inputs:
- paths:
  - "/dev/log"
  - "/var/log/messages/my-journal-file.journal"

Within the configuration file, you can also specify options that control how Journalbeat reads the journal files and which fields are sent to the configured output. See Configuration options for a list of available options.

Get familiar with the Configuration options and using the translated fields to target the exact input you want to.

{beatname_lc}.inputs:
- id: consul.service
  paths: []
  include_matches:
    - _SYSTEMD_UNIT=consul.service

- id: vault.service
  paths: []
  include_matches:
    - _SYSTEMD_UNIT=vault.service

You should use it to target the inputs you want to have pushed to elastic.

As an alternative to Journalbeat you could use Filebeat and the exclude might look like this:

type: log
paths:
{{ range $i, $path := .paths }}
 - {{$path}}
{{ end }}
exclude_files: [".gz$"]
exclude_lines: ['.*INFO.*']

Hope this helps you a bit.

user_31563330

To apply filter use:

logging.level: warning

Use this instruction to drop event journalbeat.service:

processors:
  - drop_event:
      when:
        equals:
          systemd.unit: "journalbeat.service"
user_76310660
Related