I just want to “ignore” some log messages. If you have better solutions, I will be also happy
My plan is:
- use inputs/extractor to add a field “skip” (Store as field: skip)
- use pipeline/filter to drop all messages with the field “skip”
The extractor look fine, but my messages are not dropped.
Thats I wrote as filter:
rule "skip" when has_field ("skip") then drop_message(); end
Is it not possible to use such a custum field for a filter? What can I do or is just my filter wrong?
At the moment, I just move them to a separated stream, but I want to ignore/delete them.