# How to filter or drop unwanted data before it consumes Graylog traffic license?

**URL:** <https://community.graylog.org/t/how-to-filter-or-drop-unwanted-data-before-it-consumes-graylog-traffic-license/37164>\
**Category:** Graylog Central (peer support)\
**Created:** [April 10, 2026, 5:23am UTC](https://community.graylog.org/t/how-to-filter-or-drop-unwanted-data-before-it-consumes-graylog-traffic-license/37164 "2026-04-10T05:23:36Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![yi.yao](https://avatars.discourse-cdn.com/v4/letter/y/c37758/32.png) [@yi.yao](https://community.graylog.org/u/yi.yao)\
**Post date:** [April 10, 2026, 5:23am UTC](https://community.graylog.org/t/how-to-filter-or-drop-unwanted-data-before-it-consumes-graylog-traffic-license/37164/1 "2026-04-10T05:23:36Z")

</div>

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.  
**Don’t forget to select tags to help index your topic!**

**1. Describe your incident:**

I am running **Graylog 7.0.5** and noticed that a large amount of incoming data is not actually useful for my use cases.  
Even though I do not search or store this data long-term, it still **counts against my Graylog traffic license** , which is causing unnecessary license consumption.

My goal is to **prevent completely unwanted messages from being ingested by Graylog** , so they do **not consume traffic/license at all**.

**2. Describe your environment:**

- OS Information:  
Linux (CentOS / Rocky Linux / RHEL-like)

- Package Version:  
Graylog 7.0.5  
OpenSearch backend  
MongoDB

- Service logs, configurations, and environment variables:  
Logs are mainly collected via inputs (for example: Syslog / GELF / Beats)

- Some sources constantly send low-value or noisy logs (health checks, debug logs, frequent info logs, etc.)

- Pipelines are already used for field extraction and routing

**3. What steps have you already taken to try and solve the problem?**  
I have considered:

- Stream rules

- Pipeline rules (dropping messages in pipelines)

**4. How can the community help?**  
I would like to understand:

- Is there **any supported way in Graylog 7.x** to filter or drop messages **before they consume the traffic license**?

**Helpful Posting Tips:** [Tips for Posting Questions that Get Answers](https://community.graylog.org/t/tips-for-posting-questions-that-get-answers/21828) [Hold down CTRL and link on link to open tips documents in a separate tab]

---

<div class="post-metadata">

**Author:** ![Wine\_Merchant](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/wine_merchant/32/14596_2.png) [@Wine\_Merchant](https://community.graylog.org/u/Wine_Merchant)\
**Post date:** [April 10, 2026, 9:56am UTC](https://community.graylog.org/t/how-to-filter-or-drop-unwanted-data-before-it-consumes-graylog-traffic-license/37164/2 "2026-04-10T09:56:47Z")

</div>

Hey @yi.yao,

Messages can be dropped within a pipeline using the example rule below, you will want to edit it so that it is targeted to the logs you wish to drop.

```auto
rule "Drop Messages"
when
contains(to_string($message.message), "useless_information")
then
   drop_message();
end

```

---

<div class="post-metadata">

**Author:** ![Joel\_Duffield](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Joel\_Duffield](https://community.graylog.org/u/Joel_Duffield)\
**Post date:** [April 10, 2026, 10:52am UTC](https://community.graylog.org/t/how-to-filter-or-drop-unwanted-data-before-it-consumes-graylog-traffic-license/37164/3 "2026-04-10T10:52:18Z")

</div>

Your ingestion is counted as the logs are stored to disk, so if you use either of those methods to drop message it will not count against your license. It does not matter how much is processed, just how much is stored.

---

<div class="post-metadata">

**Author:** ![plessley](https://avatars.discourse-cdn.com/v4/letter/p/bb73d2/32.png) [@plessley](https://community.graylog.org/u/plessley)\
**Post date:** [April 10, 2026, 4:56pm UTC](https://community.graylog.org/t/how-to-filter-or-drop-unwanted-data-before-it-consumes-graylog-traffic-license/37164/4 "2026-04-10T16:56:04Z")

</div>

Remember too- depending on what you’re using to send logs you can filter at that point too- NXLog, Beats and syslog all have the ability to filter/restrict data sent, which has the added benefit of less traffic on the wire as well.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [April 24, 2026, 4:56pm UTC](https://community.graylog.org/t/how-to-filter-or-drop-unwanted-data-before-it-consumes-graylog-traffic-license/37164/5 "2026-04-24T16:56:30Z")

</div>

Closed on April 24, 2026, 4:56pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.