Hi, I want a fluentbit filter that would drop only INFO level records that contains keyword "healthcheck" (will apply regex here). Appreciate the help! Sample log

{
  "@timestamp": "2025-10-08T17:47:06.0808Z",
  "level": "DEBUG",
  "message": "healthcheck"
}
{
  "@timestamp": "2025-10-08T17:47:07.1234Z",
  "level": "INFO",
  "message": "healthcheck Application started successfully"
}
{
  "@timestamp": "2025-10-08T17:47:07.1234Z",
  "level": "INFO",
  "message": "health-check test Application started successfully"
}

Expected Output

[0] tail.0: [1760122642.884274043, {"log"=>"{"}]
[1] tail.0: [1760122642.885037709, {"log"=>"  "@timestamp": "2025-10-08T17:47:06.0808Z","}]
[2] tail.0: [1760122642.885040918, {"log"=>"  "level": "DEBUG","}]
[3] tail.0: [1760122642.885042001, {"log"=>"  "message": "healthcheck""}]

fluent-bit.conf

[INPUT]
    Name            tail
    Path            /fluent-bit/etc/log
    Inotify_Watcher false
    Read_from_Head  True

[FILTER]
    Name   grep
    Match  *
    Regex  level  ^INFO$

[FILTER]
    Name    grep
    Match   *
    Exclude message (?i)(healthcheck)

[OUTPUT]
    Name    stdout
    Match   *

I think you want the multiple conditions option. https://docs.fluentbit.io/manual/data-pipeline/filters/grep

@Pat yes that's correct! I want to only exclude logs that has level info and message contains keyword "*healthcheck*". I tried grep filter but that did not worked. Would you have any other suggestions? Thanks for your help.

[FILTER]
    Name   grep
    Match  *
    Regex  level  ^INFO$

[FILTER]
    Name    grep
    Match   *
    Exclude message (?i)(healthcheck)

did you try the multiple conditions as I say, that's what you want

yup, the below config did not worked either.

[FILTER]
    Name            grep
    Alias           ignore-healthchecks
    Match           *
    Logical_Op      and
    Exclude         level (?i)(info)
    Exclude         message (?i)(healthcheck)