title: How to filter json data in filebeat yml file
body: <p>While using kafka input, I want to output only when json data contains a specific string.</p>
  <p>I tried setting &quot;include_lines&quot; in filebeat.yml, but it was not filtered properly.</p>
  <p>When the filebit.yml setting is as follows and data-set1 and 2 are input, not only data-set1 but also data-set2 are output.</p>
  <p>I expected only data-set 1 to be output, but it wasn't.</p>
  <p>What did I make a mistake?</p>
  <ul>
  <li><p>part of the filebeat.yml</p>
  <pre><code>filebeat.inputs:
  - type: kafka
    hosts:
      - qa-parkbae-01.hanpda.com:9092,
      - qa-parkbae-02.hanpda.com:9092,
      - qa-parkbae-03.hanpda.com:9092
    topics: [&quot;parkbae-test-topic1&quot;]
    group_id: &quot;test123&quot;
    ssl.enabled: false
  
    include_lines: ['\&quot;event\&quot;:\&quot;basket\&quot;']
  
  </code></pre>
  </li>
  <li><p>input data-set1 :<br />
  {&quot;id&quot;:&quot;parkbae&quot;,&quot;event&quot;:&quot;basket&quot;,&quot;data&quot;:&quot;test1&quot;}</p>
  </li>
  <li><p>input data-set2 :<br />
  {&quot;id&quot;:&quot;parkbae&quot;,&quot;event&quot;:&quot;ball&quot;,&quot;data&quot;:&quot;test2&quot;}</p>
  </li>
  </ul>