# Graylog exclude option not working for my input

**URL:** <https://community.graylog.org/t/graylog-exclude-option-not-working-for-my-input/4477>\
**Category:** Graylog Central (peer support)\
**Created:** [March 7, 2018, 9:54am UTC](https://community.graylog.org/t/graylog-exclude-option-not-working-for-my-input/4477 "2018-03-07T09:54:36Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![jaikumarkrishna](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jaikumarkrishna/32/1101_2.png) [@jaikumarkrishna](https://community.graylog.org/u/jaikumarkrishna)\
**Post date:** [March 7, 2018, 9:54am UTC](https://community.graylog.org/t/graylog-exclude-option-not-working-for-my-input/4477/1 "2018-03-07T09:54:36Z")

</div>

HI,

I am processing sql error log files . Below 2 lines are my input .

I want to ignore first line input format , it pickes secondline format data.  
2018-03-07 15:05:01.90 Logon Error: 18456, Severity: 14, State: 7.  
2018-03-07 15:05:01.90 Logon Login failed for user ‘usr’. Reason: An error occurred while evaluating the password. [CLIENT: 1.1.1.1]

So in collector filebeat configuration in exclude option i gave below regex. I dont thing any problem with regex.  
^%{DATE} %{TIME}\s+Logon\s+Error:\s+[\d]+,\s+Severity:\s+[\d]+,\s+State:\s+[\d]+.

![regex](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/f/fc36227d15375795dff16fad394bece7caf46e76.JPG)

, but still i am getting first line inputs. Please help me to resolve the issue. ![filebeat_config](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/e/eabdc86577398d4364d76edf8b85e7772afd8c71.JPG)

Thanks,  
Jay’

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [March 7, 2018, 9:59am UTC](https://community.graylog.org/t/graylog-exclude-option-not-working-for-my-input/4477/2 "2018-03-07T09:59:08Z")

</div>

Hej Jay

Graylog did not work with multiline Grok Pattern currently.

for reference: [https://github.com/Graylog2/graylog2-server/issues/2465](https://github.com/Graylog2/graylog2-server/issues/2465)

---

<div class="post-metadata">

**Author:** ![jaikumarkrishna](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jaikumarkrishna/32/1101_2.png) [@jaikumarkrishna](https://community.graylog.org/u/jaikumarkrishna)\
**Post date:** [March 7, 2018, 10:02am UTC](https://community.graylog.org/t/graylog-exclude-option-not-working-for-my-input/4477/3 "2018-03-07T10:02:39Z")

</div>

Hi Jan,

Thanks for your reply.  
Below lines are 2 different type of inputs , **all are single line format** , I want to ignore first input and my collector ll pick second format. So i am using regex to achieve this. But its not excluding first format.

**2018-03-07 15:05:01.90 Logon Error: 18456, Severity: 14, State: 7.**  
**2018-03-07 15:05:01.90 Logon Login failed for user ‘usr’. Reason: An error occurred while valuating the password. [CLIENT: 1.1.1.1]**

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [March 7, 2018, 12:49pm UTC](https://community.graylog.org/t/graylog-exclude-option-not-working-for-my-input/4477/4 "2018-03-07T12:49:56Z")

</div>

sorry misunderstood

Filebeat did not know GROK - you need to use full regex for that.

---

<div class="post-metadata">

**Author:** ![jaikumarkrishna](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jaikumarkrishna/32/1101_2.png) [@jaikumarkrishna](https://community.graylog.org/u/jaikumarkrishna)\
**Post date:** [March 7, 2018, 12:51pm UTC](https://community.graylog.org/t/graylog-exclude-option-not-working-for-my-input/4477/5 "2018-03-07T12:51:40Z")

</div>

Thanks Jan,

Let me try with regex.

---

<div class="post-metadata">

**Author:** ![jaikumarkrishna](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jaikumarkrishna/32/1101_2.png) [@jaikumarkrishna](https://community.graylog.org/u/jaikumarkrishna)\
**Post date:** [March 8, 2018, 4:50am UTC](https://community.graylog.org/t/graylog-exclude-option-not-working-for-my-input/4477/6 "2018-03-08T04:50:55Z")

</div>

HI Jan,  
I given below regex to exclude  
**2018-03-07 15:05:01.90 Logon Error: 18456, Severity: 14, State: 7**  
**^[\d]+-[\d]+-[\d]+\s+[\d]+:[\d]+:[\d]+.[\d]+\s+Logon\s+Error:\s+[\d]+,\s+Severity:\s+[\d]+,\s+State:\s+[\d]+**  
but its not excluding .  
Thanks,  
Jay’

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [March 22, 2018, 4:51am UTC](https://community.graylog.org/t/graylog-exclude-option-not-working-for-my-input/4477/7 "2018-03-22T04:51:25Z")

</div>

Closed on March 22, 2018, 4:51am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.