Auditbeat - Drop events

Hi there,

I'm looking to drop all successful events collected with Auditbeat:
At the end of my yaml file I've put this:
- drop_event:
auditd.result: "success"

But in Kibana I still can see results auditd.result with the value success.

Any ideas?


ok got it,
My syntax was OK but the indentation was bad.......
Now it works.

@elastic_bees Thanks for updating this, the YAML syntax is somewhat error-prone, but we want to make the validations better in upcoming version.