title: Filtering messages out of logstash.conf
body: <p>My logstash.conf can be seen below.</p>
  
  <p>How would I go about filtering out messages which include a specific string? In this case, some of my messages are reading as "DEBUG: xxx-xxx-xxx", and I would like for these to be filtered OUT of logstash.</p>
  
  <pre><code>input {
    tcp {
      port =&gt; 5000
      type =&gt; syslog
    }
    udp {
      port =&gt; 5000
      type =&gt; syslog
    }
  }
  filter {
    if [loglevel] == "debug" {
        drop { }
    }
  
    if [type] == "syslog" {
      grok {
        match =&gt; { 
        "message" =&gt; "%{SYSLOG5424PRI}%{NONNEGINT:ver} +(?:%  {TIMESTAMP_ISO8601:ts}|-) +(?:%{HOSTNAME:containerid}|-) +(?:%{NOTSPACE:containername}|-) 
        +(?:%{NOTSPACE:proc}|-) +(?:%{WORD:msgid}|-) +(?:%{SYSLOG5424SD:sd}|-|) +%{GREEDYDATA:msg}" }
  }   
    syslog_pri { } 
      date {
        match =&gt; [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
      }   
     if !("_grokparsefailure" in [tags]) {
       mutate {
          replace =&gt; [ "@source_host", "%{syslog_hostname}" ]
          replace =&gt; [ "@message", "%{syslog_message}" ]
        }   
      }   
      mutate {
        remove_field =&gt; [ "syslog_hostname", "syslog_message", "syslog_timestamp" ]
      }   
    }
  
  }
  
  output {
    elasticsearch { host =&gt; "elasticsearch" }
    stdout { codec =&gt; rubydebug }
  }
  </code></pre>
  
  <p><strong>EDIT:</strong>
  I should clarify that it is the GREEDYDATA:msg field that I wish to drop if it includes a "DEBUG" message.</p>