# \[collector\]\[filebeat\] lines to exclude using multiple regexp

**URL:** <https://community.graylog.org/t/collector-filebeat-lines-to-exclude-using-multiple-regexp/1006>\
**Category:** Graylog Central (peer support)\
**Created:** [May 2, 2017, 12:32pm UTC](https://community.graylog.org/t/collector-filebeat-lines-to-exclude-using-multiple-regexp/1006 "2017-05-02T12:32:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gl-user1337](https://avatars.discourse-cdn.com/v4/letter/g/ecb155/32.png) [@gl-user1337](https://community.graylog.org/u/gl-user1337)\
**Post date:** [May 2, 2017, 12:32pm UTC](https://community.graylog.org/t/collector-filebeat-lines-to-exclude-using-multiple-regexp/1006/1 "2017-05-02T12:32:08Z")

</div>

Hello,

I’m trying to use multiple regexp to exclude lines from logs sent by collector/filebeat.  
In the web interface, I entered regexps in the format:  
[’._test.domain.foo.bar._’, ‘._[test.domain.foo.com](http://test.domain.foo.com)._’, …]

In the resulting generated Filebeat log, I have my regexp under lines to exclude w/ one line per regexp (lines are dns.json from suricata):

- ‘._test.domain.foo.bar._’
- ‘._[test.domain.foo.com](http://test.domain.foo.com)._’

Problem is that matching lines still get sent to Graylog.

Anyone with an idea or exact syntax to use it?

---

<div class="post-metadata">

**Author:** ![marius](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/marius/32/14_2.png) [@marius](https://community.graylog.org/u/marius)\
**Post date:** [May 2, 2017, 1:53pm UTC](https://community.graylog.org/t/collector-filebeat-lines-to-exclude-using-multiple-regexp/1006/2 "2017-05-02T13:53:43Z")

</div>

Hi,  
your syntax looks fine to me. Maybe the pattern doesn’t match the log messages you want to exclude?

I would try it with `['.*test.domain.foo.bar.*']` instead. Further readings can be found here:

[https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html#exclude-lines](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html#exclude-lines)

and

[https://www.elastic.co/guide/en/beats/filebeat/current/regexp-support.html](https://www.elastic.co/guide/en/beats/filebeat/current/regexp-support.html)

Cheers,  
Marius

---

<div class="post-metadata">

**Author:** ![gl-user1337](https://avatars.discourse-cdn.com/v4/letter/g/ecb155/32.png) [@gl-user1337](https://community.graylog.org/u/gl-user1337)\
**Post date:** [May 3, 2017, 6:43am UTC](https://community.graylog.org/t/collector-filebeat-lines-to-exclude-using-multiple-regexp/1006/3 "2017-05-03T06:43:14Z")

</div>

Hi Marius,

Just made a copy/paste error when posting my initial message, didn’t saw that your platform is escaping them 🙂 My regexp are indeed in the form like you propose:

- .\*test\.domain-1\.foo\.bar.\*

Validated then in Go against full message and they are correct. Just upgraded to collector 0.1.1, will try to see if it changes anything.

---

<div class="post-metadata">

**Author:** ![gl-user1337](https://avatars.discourse-cdn.com/v4/letter/g/ecb155/32.png) [@gl-user1337](https://community.graylog.org/u/gl-user1337)\
**Post date:** [May 3, 2017, 7:50am UTC](https://community.graylog.org/t/collector-filebeat-lines-to-exclude-using-multiple-regexp/1006/4 "2017-05-03T07:50:00Z")

</div>

Ok, problem is in fact only on domains with dash ‘-’ in them that do not get filtered using:

- .\*test.domain-1.foo.bar.\*
- .\*test.domain\-1.foo.bar.\*
- .\*test.domain.\*foo.bar.\*