# \[Auditbeat 7.6 - 7.2\] Processor not working

**URL:** https://discuss.elastic.co/t/auditbeat-7-6-7-2-processor-not-working/220982
**Category:** Beats
**Tags:** auditbeat
**Created:** [February 26, 2020, 8:47am UTC](https://discuss.elastic.co/t/auditbeat-7-6-7-2-processor-not-working/220982 "2020-02-26T08:47:17Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![tienbmaa](https://avatars.discourse-cdn.com/v4/letter/t/e79b87/32.png) [@tienbmaa](https://discuss.elastic.co/u/tienbmaa)
#### Post date: [February 26, 2020, 8:47am UTC](https://discuss.elastic.co/t/auditbeat-7-6-7-2-processor-not-working/220982/1 "2020-02-26T08:47:17Z")

</div>

Hi all,  
I have problem about auditbeat processor.  
I have entry log, I config processor drop\_event when user.name: "root" but system not woking (event not droped):

# Processor Config:

```
processors:
 - drop_event:
     when:
        contains:
          user.name: "root" 

```

# Log entry:

```
{
  "_index": "auditbeat-7.6.0-2020.02",
  "_type": "_doc",
  "_id": "YlikgHABtt-vWiG1ysfn",
  "_version": 1,
  "_score": null,
  "_source": {
    "@timestamp": "2020-02-26T08:37:27.420Z",
    "user": {
      "effective": {
        "group": {
          "name": "root",
          "id": "0"
        },
        "id": "0",
        "name": "root"
      },
      "group": {
        "id": "0",
        "name": "root"
      },
      "name": "root",
      "saved": {
        "name": "root",
        "group": {
          "id": "0",
          "name": "root"
        },
        "id": "0"
      },
      "id": "0",
      "filesystem": {
        "name": "root",
        "id": "0",
        "group": {
          "id": "0",
          "name": "root"
        }
      },
      "audit": {
        "name": "root",
        "id": "0"
      }
    },
    "process": {
      "title": "ls --color=auto -l --color=auto",
      "name": "ls",
      "executable": "/usr/bin/ls",
      "args": [
        "ls",
        "--color=auto",
        "-l",
        "--color=auto"
      ],
      "pid": 24279,
      "ppid": 5201
    },
    "tags": [
      "rootcmd"
    ],
    "host": {
      "architecture": "x86_64",
      "os": {
        "codename": "Core",
        "platform": "centos",
        "version": "7 (Core)",
        "family": "redhat",
        "name": "CentOS Linux",
        "kernel": "3.10.0-693.2.2.el7.x86_64"
      },
      "name": "MCR-LIVE-BACKUP",
      "id": "f955206775b64e62acdcd881d0e1d4f3",
      "containerized": false,
      "hostname": "MCR-LIVE-BACKUP"
    },
    "agent": {
      "id": "962daac4-770f-4cdd-949c-984c914a76ae",
      "version": "7.6.0",
      "type": "auditbeat",
      "ephemeral_id": "958a5241-678f-42ea-958f-02c099decd7b",
      "hostname": "MCR-LIVE-BACKUP"
    },
    "event": {
      "module": "auditd",
      "category": "audit-rule",
      "action": "executed",
      "outcome": "success"
    },
    "file": {
      "device": "00:00",
      "inode": "100679299",
      "mode": "0755",
      "uid": "0",
      "gid": "0",
      "owner": "root",
      "group": "root",
      "path": "/usr/bin/ls"
    },
    "auditd": {
      "sequence": 972496,
      "result": "success",
      "data": {
        "tty": "pts0",
        "a3": "7ffde00a2720",
        "a0": "13fae10",
        "argc": "4",
        "a2": "13fae50",
        "arch": "x86_64",
        "syscall": "execve",
        "exit": "0",
        "a1": "13efef0"
      },
      "session": "79464",
      "summary": {
        "actor": {
          "primary": "root",
          "secondary": "root"
        },
        "object": {
          "primary": "/usr/bin/ls",
          "type": "file"
        },
        "how": "/usr/bin/ls"
      },
      "paths": [
        {
          "inode": "100679299",
          "item": "0",
          "ouid": "0",
          "objtype": "NORMAL",
          "ogid": "0",
          "rdev": "00:00",
          "dev": "fd:00",
          "mode": "0100755",
          "name": "/usr/bin/ls"
        },
        {
          "dev": "fd:00",
          "inode": "716939",
          "item": "1",
          "objtype": "NORMAL",
          "ogid": "0",
          "mode": "0100755",
          "name": "/lib64/ld-linux-x86-64.so.2",
          "ouid": "0",
          "rdev": "00:00"
        }
      ],
      "message_type": "syscall"
    },
    "service": {
      "type": "auditd"
    },
    "ecs": {
      "version": "1.4.0"
    }
  },
  "fields": {
    "@timestamp": [
      "2020-02-26T08:37:27.420Z"
    ]
  },
  "sort": [
    1582706247420
  ]
}

```

Can you help me?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 25, 2020, 10:54am UTC](https://discuss.elastic.co/t/auditbeat-7-6-7-2-processor-not-working/220982/2 "2020-03-25T10:54:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.