Filter log with single word with grep

[BlaBlaGITTE]

Hi all,
Is it possible exclude a record from log that contains only a single word for each row?

for eg:
none
none
none
found

I guess a regex similar to this: ^none$

[FILTER]
name grep
match *
regex ^none$

Thanks in advance.

[RicardoAAD]

Hello @BlaBlaGITTE
To exclude all records with only one word(with no blank spaces), you can use this regex ^(\w+)$.

Config example:

[INPUT]
   name tail
   path test.log
   read_from_head true
[FILTER]
   name   grep
   match  *
   exclude log ^(\w+)$
[OUTPUT]
   name stdout
   match *

Log example:

THIS LINE HAS FIVE WORDS


ALL
THESE
LINES
HAVE
ONE
WORD
THIS IS A MULTIWORD LINE
AND
NO
BLANK
SPACES

Fluent bit output:

gh-6634$ ../fluent-bit -c config2.conf
Fluent Bit v2.0.9
* Copyright (C) 2015-2022 The Fluent Bit Authors
* Fluent Bit is a CNCF sub-project under the umbrella of Fluentd
* https://fluentbit.io

[2023/01/23 15:52:16] [ info] [fluent bit] version=2.0.9, commit=27f490ccee, pid=1514482
[2023/01/23 15:52:16] [ info] [storage] ver=1.4.0, type=memory, sync=normal, checksum=off, max_chunks_up=128
[2023/01/23 15:52:16] [ info] [cmetrics] version=0.5.8
[2023/01/23 15:52:16] [ info] [ctraces ] version=0.2.7
[2023/01/23 15:52:16] [ info] [input:tail:tail.0] initializing
[2023/01/23 15:52:16] [ info] [input:tail:tail.0] storage_strategy='memory' (memory only)
[2023/01/23 15:52:16] [ info] [sp] stream processor started
[2023/01/23 15:52:16] [ info] [output:stdout:stdout.0] worker #0 started
[2023/01/23 15:52:16] [ info] [input:tail:tail.0] inotify_fs_add(): inode=1050578 watch_fd=1 name=test6634.log
[0] tail.0: [1674489136.347427783, {"log"=>"THIS LINE HAS FIVE WORDS"}]
[1] tail.0: [1674489136.347432783, {"log"=>""}]
[2] tail.0: [1674489136.347433083, {"log"=>""}]
[3] tail.0: [1674489136.347435083, {"log"=>"THIS IS A MULTIWORD LINE"}]

Please let us know if this example worked for you.

Regards,

[BlaBlaGITTE]

Yess,
It works thanks :)