# Dropping some log messages with specific field value **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [June 6, 2017, 10:35am UTC](https://community.graylog.org/t/dropping-some-log-messages-with-specific-field-value/1357 "2017-06-06T10:35:03Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Mbuyukkarakas](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mbuyukkarakas/32/410_2.png) [@Mbuyukkarakas](https://community.graylog.org/u/Mbuyukkarakas)\ **Post date:** [June 6, 2017, 10:35am UTC](https://community.graylog.org/t/dropping-some-log-messages-with-specific-field-value/1357/1 "2017-06-06T10:35:04Z")
Dear all, I would like to drop some syslog messages before wring to indexes. Some log records contains particular IP addresses and I want to write a rule like IF source=“xxx” AND IF ip=172.1.1.1 THEN drop. I cant find a good resource which explains this. Graylog documentation about pipelines wasnt good enough. Thank you. Mehmet ---
**Author:** ![derPhlipsi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/derphlipsi/32/38_2.png) [@derPhlipsi](https://community.graylog.org/u/derPhlipsi)\ **Post date:** [June 6, 2017, 11:44am UTC](https://community.graylog.org/t/dropping-some-log-messages-with-specific-field-value/1357/2 "2017-06-06T11:44:34Z")
Hey @Mbuyukkarakas, you actually can just use a pipeline to do that. ```auto rule "dropOnIP" when $message.source = "xxx" AND $message.ip = "127.1.1.1" then drop_message(); end ``` You can either use multiple rules for every IP you want to drop on, or if you are willing to go onto the newest snapshot you can use the new lookup function explained here: > **[Announcing Graylog v2.3.0-alpha.2 | The Graylog Blog](https://www.graylog.org/post/announcing-graylog-v2-3-0-alpha-2)** > > This is the first public alpha release on our journey to Graylog v2.3! For Graylog v2.3, we are focusing on two main features: support for Elasticsearch 5 and Lookup Tables. Greetings - Phil ---
**Author:** ![Mbuyukkarakas](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mbuyukkarakas/32/410_2.png) [@Mbuyukkarakas](https://community.graylog.org/u/Mbuyukkarakas)\ **Post date:** [June 6, 2017, 12:16pm UTC](https://community.graylog.org/t/dropping-some-log-messages-with-specific-field-value/1357/3 "2017-06-06T12:16:52Z")
Phil, thank you. I will try all of these and will write back here. Regards. ---
**Author:** ![Mbuyukkarakas](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mbuyukkarakas/32/410_2.png) [@Mbuyukkarakas](https://community.graylog.org/u/Mbuyukkarakas)\ **Post date:** [June 6, 2017, 2:22pm UTC](https://community.graylog.org/t/dropping-some-log-messages-with-specific-field-value/1357/4 "2017-06-06T14:22:10Z")
Bad news. I couldnt use this config. The raw log is an apache access log. I used some grok patterns to parse the IP addresses. What I need is to write something like this if log\_source\_server = XXX and IP=y.y.y.y then drop. I need this because I want to drop most of logs which are about local IP addresses. I just need the public IP’s. I remarked the local IP’s are one or two different but %90 of logs are about these IP’s. Basically I need to drop them. Thank you. ---
**Author:** ![derPhlipsi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/derphlipsi/32/38_2.png) [@derPhlipsi](https://community.graylog.org/u/derPhlipsi)\ **Post date:** [June 6, 2017, 3:02pm UTC](https://community.graylog.org/t/dropping-some-log-messages-with-specific-field-value/1357/5 "2017-06-06T15:02:25Z")
Hey, is your source field the hostname of your server? If yes, then use the field gl2\_remote\_ip instead. Greetings - Phil ---
**Author:** ![Mbuyukkarakas](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mbuyukkarakas/32/410_2.png) [@Mbuyukkarakas](https://community.graylog.org/u/Mbuyukkarakas)\ **Post date:** [June 7, 2017, 8:36am UTC](https://community.graylog.org/t/dropping-some-log-messages-with-specific-field-value/1357/6 "2017-06-07T08:36:46Z")
Phil, The source field is not the graylog server. One of my linux servers is sending the logs. So, graylog srv : 192.168.2.10 web srv . : 192.168.2.11 The IP that I want to discard : 192.168.7.10 IF source = 192.168.2.11 AND IP=192.168.7.10 then discard. Exactly what I need. Thank you. ---
**Author:** ![derPhlipsi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/derphlipsi/32/38_2.png) [@derPhlipsi](https://community.graylog.org/u/derPhlipsi)\ **Post date:** [June 7, 2017, 1:15pm UTC](https://community.graylog.org/t/dropping-some-log-messages-with-specific-field-value/1357/7 "2017-06-07T13:15:41Z")
Hey, gl2\_remote\_ip is the value of the remote ip that send the message to Graylog, so it is your web server ip (192.168.2.11). So, from my understanding this is what you need: ```auto rule "dropOnIP" when $message.gl2_remote_ip = "192.168.2.11" AND $message.ip = "192.168.7.10" // I assume that you extract the ip-to-be-dropped-on into the field ip then drop_message(); end ``` Add this rule to a pipeline and connect that pipeline to a stream the message is running through, that should work. If I get access to my environment I can test this, but this will not be before saturday… Greetings - Phil ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [June 21, 2017, 1:15pm UTC](https://community.graylog.org/t/dropping-some-log-messages-with-specific-field-value/1357/8 "2017-06-21T13:15:45Z")
Closed on June 21, 2017, 1:15pm UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.