# Filter logs Received

**URL:** <https://community.graylog.org/t/filter-logs-received/32977>\
**Category:** Graylog Central (peer support)\
**Tags:** documentation\
**Created:** [July 15, 2024, 7:02am UTC](https://community.graylog.org/t/filter-logs-received/32977 "2024-07-15T07:02:38Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![badaroed](https://avatars.discourse-cdn.com/v4/letter/b/ebca7d/32.png) [@badaroed](https://community.graylog.org/u/badaroed)\
**Post date:** [July 15, 2024, 7:02am UTC](https://community.graylog.org/t/filter-logs-received/32977/1 "2024-07-15T07:02:38Z")

</div>

Gentlemen, what’s up?

Is there any way to filter the logs received in Graylog?

I’m asking because of my scenario, where I’m receiving logs from Vmware EXSI, and there are a lot of them every day… which quickly fills up the SRV Graylog disk…

---

<div class="post-metadata">

**Author:** ![Joel\_Duffield](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Joel\_Duffield](https://community.graylog.org/u/Joel_Duffield)\
**Post date:** [July 15, 2024, 7:17am UTC](https://community.graylog.org/t/filter-logs-received/32977/2 "2024-07-15T07:17:48Z")

</div>

Absolutly! If you have a pipeline rule wirh something in the when clause measage\_type = something I dont care about, and in the then clause you have the function drop\_mesaage, then those messages will be dropped and never be stored.

---

<div class="post-metadata">

**Author:** ![badaroed](https://avatars.discourse-cdn.com/v4/letter/b/ebca7d/32.png) [@badaroed](https://community.graylog.org/u/badaroed)\
**Post date:** [July 18, 2024, 1:08pm UTC](https://community.graylog.org/t/filter-logs-received/32977/3 "2024-07-18T13:08:14Z")

</div>

Is there a step-by-step document on how to do it?

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [July 25, 2024, 3:46am UTC](https://community.graylog.org/t/filter-logs-received/32977/4 "2024-07-25T03:46:08Z")

</div>

Hey @badaroed

First setup you Pipeline.

[https://go2docs.graylog.org/5-0/making\_sense\_of\_your\_log\_data/pipelines.html](https://go2docs.graylog.org/5-0/making_sense_of_your_log_data/pipelines.html)  
The pipeline page you need name the pipeline, attach the stream and add the rule.

Example of pipeline rule

```auto
rule “Drop Syslog Messages”
when
   has_field("level") AND
   ( to_string($message.level) == “7” OR
     lowercase(to_string($message.level)) == "debug" )
then
   drop_message();
end

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 8, 2024, 3:46am UTC](https://community.graylog.org/t/filter-logs-received/32977/5 "2024-08-08T03:46:34Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.