Auditbeat - Drop events

Elastic Stack Beats
1

Hi there,

I'm looking to drop all successful events collected with Auditbeat:
At the end of my yaml file I've put this:
processors:
- drop_event:
when:
auditd.result: "success"

But in Kibana I still can see results auditd.result with the value success.

Any ideas?

Thanks

2

ok got it,
My syntax was OK but the indentation was bad.......
Now it works.

3

@elastic_bees Thanks for updating this, the YAML syntax is somewhat error-prone, but we want to make the validations better in upcoming version.