> my goal is to drop all the messages without DEBUG, WARN, INFO and ERROR.

Yes, I know.

> example message withour DEBUG, INGO, ERROR, WARN

For that example message your option B works:

```plain
$ cat test.config
input { stdin { } }
output { stdout { codec => rubydebug } }
filter {
  if "DEBUG" not in [message] or "WARN" not in [message] or "INFO" not in [message] or "ERROR" not in [message] {
    drop { }
  }
}
$ echo '00: 01 00 03 03 00 00 00 08 -- -- -- -- -- -- -- -- | ........' | /opt/logstash/bin/logstash -f test.config
Settings: Default pipeline workers: 8
Pipeline main started
Pipeline main has been shutdown
stopping pipeline {:id=>"main"}
```

(Logstash isn't emitting any events, proving that the drop filter worked.)

However, for other kinds of messages you do need to follow the advice I gave earlier.

---
NEW: Monitor These Apps!
elasticsearch, apache solr, apache hbase, hadoop, redis, casssandra, amazon cloudwatch, mysql, memcached, apache kafka, apache zookeeper, apache storm, ubuntu, centOS, red hat, debian, puppet labs, java, senseiDB