logstash.conf

## maybe just drop these altogether?
      if "audit" in [tags] and [LONG_TERM_STORAGE] != "1" {
        drop { }
      }
## drop solr logs (this doesn't catch all solr logs but should get most)
      if [unit] == "tomcat.service" {
        if [message] =~ /org.apache.solr.core.SolrCore/ { drop { } }
        if [message] =~ /webapp=[\/]+solr/ { drop { } }
      }