<p>We are using journalbeat to push logs of kubernetes cluster to elastic search. It working fine and pushing the logs. However its also pushing event like &quot;200 OK&quot; and &quot;INFO&quot; which we do not want. The <code>journalbeat.yaml</code> is as follows</p>
<h3>journalbeat.yaml</h3>
<pre class="lang-yaml prettyprint-override"><code>  journalbeat.yml: |
    name: &quot;${NODENAME}&quot;
    journalbeat.inputs:
    - paths: []
      seek: cursor
      cursor_seek_fallback: tail

    processors:
    - add_kubernetes_metadata:
        host: &quot;${NODENAME}&quot;
        in_cluster: true
        default_indexers.enabled: false
        default_matchers.enabled: false
        indexers:
          - container:
        matchers:
          - fields:
              lookup_fields: [&quot;container.id&quot;]
    - decode_json_fields:
        fields: [&quot;message&quot;]
        process_array: false
        max_depth: 1
        target: &quot;&quot;
        overwrite_keys: true
    - drop_event.when:
        or:
        - regexp.kubernetes.pod.name: &quot;filebeat-.*&quot;
        - regexp.kubernetes.pod.name: &quot;journalbeat-.*&quot;
        - regexp.kubernetes.pod.name: &quot;nginx-ingress-controller-.*&quot;
        - regexp.kubernetes.pod.name: &quot;prometheus-operator-.*&quot;

    setup.template.enabled: false
    setup.template.name: &quot;journal-${ENVIRONMENT}-%{[agent.version]}&quot;
    setup.template.pattern: &quot;journal-${ENVIRONMENT}-%{[agent.version]}-*&quot;
    setup.template.settings:
      index.number_of_shards: 10
      index.refresh_interval: 10s

    output.elasticsearch:
      hosts: '${ELASTICSEARCH_HOSTS:elasticsearch:9200}'
      username: '${ELASTICSEARCH_USERNAME}'
      password: '${ELASTICSEARCH_PASSWORD}'
      index: &quot;journal-${ENVIRONMENT}-system-%{[agent.version]}-%{+YYYY.MM.dd}&quot;
      indices:
      - index: &quot;journal-${ENVIRONMENT}-k8s-%{[agent.version]}-%{+YYYY.MM.dd}&quot;
        when.has_fields:
        - 'kubernetes.namespace'
</code></pre>
<p>How can i exclude logs like &quot;INFO&quot; and &quot;200 OK&quot; events?</p>

<p>As far as I'm aware there is no way to exclude logs in <a href="https://www.elastic.co/guide/en/beats/journalbeat/current/index.html" rel="nofollow noreferrer">Journalbeat</a>. It's working other way around, meaning you tell it what input to look for.
You should read about <a href="https://www.elastic.co/guide/en/beats/journalbeat/master/configuration-journalbeat-options.html#configuration-journalbeat-options" rel="nofollow noreferrer">Configuration input</a>:</p>
<blockquote>
<p>By default, Journalbeat reads log events from the default systemd journals. To specify other journal files, set the <a href="https://www.elastic.co/guide/en/beats/journalbeat/master/configuration-journalbeat-options.html#journalbeat-paths" rel="nofollow noreferrer" title="paths"><code>paths</code></a> option in the <code>journalbeat.inputs</code> section of the <code>journalbeat.yml</code> file. Each path can be a directory path (to collect events from all journals in a directory), or a file path.</p>
</blockquote>
<pre><code>journalbeat.inputs:
- paths:
  - &quot;/dev/log&quot;
  - &quot;/var/log/messages/my-journal-file.journal&quot;
</code></pre>
<blockquote>
<p>Within the configuration file, you can also specify options that control how Journalbeat reads the journal files and which fields are sent to the configured output. See Configuration options for a list of available options.</p>
</blockquote>
<p>Get familiar with the <a href="https://www.elastic.co/guide/en/beats/journalbeat/master/configuration-journalbeat-options.html#journalbeat-options" rel="nofollow noreferrer">Configuration options</a> and using the <a href="https://www.elastic.co/guide/en/beats/journalbeat/master/configuration-journalbeat-options.html#translated-fields" rel="nofollow noreferrer">translated fields</a> to target the exact input you want to.</p>
<pre><code>{beatname_lc}.inputs:
- id: consul.service
  paths: []
  include_matches:
    - _SYSTEMD_UNIT=consul.service

- id: vault.service
  paths: []
  include_matches:
    - _SYSTEMD_UNIT=vault.service
</code></pre>
<p>You should use it to target the inputs you want to have pushed to elastic.</p>
<p>As an alternative to <a href="https://www.elastic.co/guide/en/beats/journalbeat/current/index.html" rel="nofollow noreferrer">Journalbeat</a> you could use <a href="https://www.elastic.co/beats/filebeat" rel="nofollow noreferrer">Filebeat</a> and the exclude might look like this:</p>
<pre><code>type: log
paths:
{{ range $i, $path := .paths }}
 - {{$path}}
{{ end }}
exclude_files: [&quot;.gz$&quot;]
exclude_lines: ['.*INFO.*']
</code></pre>
<p>Hope this helps you a bit.</p>
