Scroll Top

How to remove duplicated or not important messages from syslog?

Issue description

we all know this entry in the syslog:
... last message repeated ... times

can it somehow be easily ruled out?

Issue solution

Yes, they can. There are many ways to do so and below is only one such example:


filter {
  if [source] == "/ var / log / messages" {
    if [message] =~ / last message repeated [0-9] + times / {
      drop {}
    }
  }
}