<p>We are using journalbeat to push logs of kubernetes cluster to elastic search. It working fine and pushing the logs. However its also pushing event like &quot;200 OK&quot; and &quot;INFO&quot; which we do not want. The <code>journalbeat.yaml</code> is as follows</p>
<h3>journalbeat.yaml</h3>
<pre class="lang-yaml prettyprint-override"><code>  journalbeat.yml: |
    name: &quot;${NODENAME}&quot;
    journalbeat.inputs:
    - paths: []
      seek: cursor
      cursor_seek_fallback: tail

    processors:
    - add_kubernetes_metadata:
        host: &quot;${NODENAME}&quot;
        in_cluster: true
        default_indexers.enabled: false
        default_matchers.enabled: false
        indexers:
          - container:
        matchers:
          - fields:
              lookup_fields: [&quot;container.id&quot;]
    - decode_json_fields:
        fields: [&quot;message&quot;]
        process_array: false
        max_depth: 1
        target: &quot;&quot;
        overwrite_keys: true
    - drop_event.when:
        or:
        - regexp.kubernetes.pod.name: &quot;filebeat-.*&quot;
        - regexp.kubernetes.pod.name: &quot;journalbeat-.*&quot;
        - regexp.kubernetes.pod.name: &quot;nginx-ingress-controller-.*&quot;
        - regexp.kubernetes.pod.name: &quot;prometheus-operator-.*&quot;

    setup.template.enabled: false
    setup.template.name: &quot;journal-${ENVIRONMENT}-%{[agent.version]}&quot;
    setup.template.pattern: &quot;journal-${ENVIRONMENT}-%{[agent.version]}-*&quot;
    setup.template.settings:
      index.number_of_shards: 10
      index.refresh_interval: 10s

    output.elasticsearch:
      hosts: '${ELASTICSEARCH_HOSTS:elasticsearch:9200}'
      username: '${ELASTICSEARCH_USERNAME}'
      password: '${ELASTICSEARCH_PASSWORD}'
      index: &quot;journal-${ENVIRONMENT}-system-%{[agent.version]}-%{+YYYY.MM.dd}&quot;
      indices:
      - index: &quot;journal-${ENVIRONMENT}-k8s-%{[agent.version]}-%{+YYYY.MM.dd}&quot;
        when.has_fields:
        - 'kubernetes.namespace'
</code></pre>
<p>How can i exclude logs like &quot;INFO&quot; and &quot;200 OK&quot; events?</p>

codeaprendiz
<p>To apply filter use:</p>
<pre><code>logging.level: warning
</code></pre>
<p>Use this instruction to drop event <code>journalbeat.service</code>:</p>
<pre><code>processors:
  - drop_event:
      when:
        equals:
          systemd.unit: &quot;journalbeat.service&quot;
</code></pre>
