revision 4c17068639321c537e51114b17dc65ca431131fa
1 2 3 4 5 6 7 8 9 10 11
filter { grok { match => [ "message", "something" ] add_tag => [ "dropme" ] tag_on_failure => [] } if "dropme" in [tags] { drop {} } }