Filter - how to exclude logs that start with a particular word

Follow

Juan Carlos Ibarra

• November 24, 2021 20:32

I have been reading documentation and actually testing the filter I am adding but still seeing the logs coming up into sumo. This is the expression I am doing:

START RequestId.*

It suppose to exclude all entries that start with the string "START RequestId".

Any suggestion or recommendation will be appreciated.

 

0

• Official comment

  

  Rick Jury

  • November 24, 2021 20:57

  Hi Juan,

  you can use a processing rule https://help.sumologic.com/Manage/Collection/Processing-Rules/Include-and-Exclude-Rules

  say an exclude rule on your ingestion source of 
  ^START RequestId.*

  Comment actions Permalink
• 

  Juan Carlos Ibarra

  • November 24, 2021 21:20

  Thanks Rick,

  Yes that is the approach I am using but still seeing the logs being ingested.

  0

  Comment actions Permalink
• 

  Harinder Bhandari

  • November 24, 2021 21:34

  Hi Juan,

  Can you please try this RegEx:

  .*START\s+RequestId.*

  If the messages are multiline, then try this regex:

  (?s).*START\s+RequestId(?s).*

  Let us know if this works.

  Thanks.

  0

  Comment actions Permalink
• 

  Juan Carlos Ibarra

  • November 25, 2021 15:05

  Thank you Harinder, the multiple line form work as expected.

  0

  Comment actions Permalink

Please sign in to leave a comment.