title: Drop log messages containing a specific string
body: <p>So I have log messages of the format :</p>
  
  <pre><code>[INFO]  &lt;blah.blah&gt;       2016-06-27 21:41:38,263 some text
  [INFO]  &lt;blah.blah&gt;       2016-06-28 18:41:38,262 some other text
  </code></pre>
  
  <p>Now I want to drop all logs that does not contain a specific string "xyz"  and keep all the rest. I also want to index timestamp.</p>
  
  <p><a href="http://grokdebug.herokuapp.com" rel="noreferrer">grokdebug</a> is not helping much. </p>
  
  <p>This is my attempt : </p>
  
  <pre><code>input {
      file {
           path =&gt; "/Users/username/Desktop/validateLogconf/logs/*"
        start_position =&gt; "beginning"
  
     }
  }
  
  filter {
  
    grok {
        match =&gt; {
        "message" =&gt; '%{SYSLOG5424SD:loglevel}  &lt;%{JAVACLASS:job}&gt;       %{GREEDYDATA:content}'
        }
    }
  
    date {
      match =&gt; [ "Date", "YYYY-mm-dd HH:mm:ss" ]
      locale =&gt; en
    }
  
  }
  
  output {
    stdout {
  codec =&gt; plain {
                          charset =&gt; "ISO-8859-1"
                  }
  
  }
      elasticsearch {
          hosts =&gt; "http://localhost:9201"
          index =&gt; "hello"
  
    }
  }
  </code></pre>
  
  <p>I am new to grok so patterns above might not be making sense. Please help.</p>