Match a leading digit in Filebeat with a regular expression

Use a regexp condition with ^[0-9] to match a message whose first character is an ASCII digit. The ^ anchor means the beginning of the string; the pattern does not require the rest of the message to be numeric.

Drop messages that start with a digit

processors:
  - drop_event:
      when:
        regexp:
          message: '^[0-9]'

For example, this drops 2024-01-01 request completed and 7 retries, but keeps INFO 7 retries. It also keeps a message beginning with a space, because the digit is no longer the first character.

To retain only messages starting with a digit, negate the condition:

processors:
  - drop_event:
      when:
        not:
          regexp:
            message: '^[0-9]'

A missing message, or an unsupported scalar type such as a number, does not satisfy this condition, so the negated rule drops that event. Filebeat's matcher also supports arrays of strings, where a matching element can satisfy the condition. Check the actual event shape and your deployed version before applying the rule globally.

Separate multiline grouping from event filtering

For a filestream input, this groups continuation lines under a date-prefixed first line:

filebeat.inputs:
  - type: filestream
    id: dated-application-log
    paths: ['/var/log/myapp/*.log']
    parsers:
      - multiline:
          type: pattern
          pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
          negate: true
          match: after

This recognizes a date-shaped prefix; it does not validate calendar dates. Pick a boundary that matches the application's actual format. Processor filtering applies to the resulting event, which may contain several original lines.

Quote patterns carefully

Single-quoted YAML preserves backslashes, so '^[0-9]' is easy to read. The equivalent digit shorthand is '^\d' in single quotes or "^\\d" in double quotes. To permit leading whitespace, use '^\s*[0-9]'; to require an entirely numeric string, use '^[0-9]+$'.

Combine conditions with and when a message must also contain ERROR. Do not use a starts_with condition: it is not in Filebeat's documented condition set. Elastic lists the supported processors and conditions and filestream parser options.