# Auditbeat - Drop events
**URL:** https://discuss.elastic.co/t/auditbeat-drop-events/127585
**Category:** Beats
**Tags:** auditbeat
**Created:** [April 11, 2018, 8:03am UTC](https://discuss.elastic.co/t/auditbeat-drop-events/127585 "2018-04-11T08:03:15Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@elastic\_bees](https://discuss.elastic.co/u/elastic_bees)
#### Post date: [April 11, 2018, 8:03am UTC](https://discuss.elastic.co/t/auditbeat-drop-events/127585/1 "2018-04-11T08:03:15Z")
Hi there,
I'm looking to drop all successful events collected with Auditbeat:
At the end of my yaml file I've put this:
processors:
- drop\_event:
when:
auditd.result: "success"
But in Kibana I still can see results auditd.result with the value success.
Any ideas?
Thanks
---
### Author:  [@elastic\_bees](https://discuss.elastic.co/u/elastic_bees)
#### Post date: [April 11, 2018, 9:59am UTC](https://discuss.elastic.co/t/auditbeat-drop-events/127585/2 "2018-04-11T09:59:50Z")
ok got it,
My syntax was OK but the indentation was bad.......
Now it works.
---
### Author:  [@pierhugues](https://discuss.elastic.co/u/pierhugues)
#### Post date: [April 11, 2018, 2:27pm UTC](https://discuss.elastic.co/t/auditbeat-drop-events/127585/3 "2018-04-11T14:27:07Z")
@elastic_bees Thanks for updating this, the YAML syntax is somewhat error-prone, but we want to make the validations better in upcoming version.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 4, 2022, 5:19am UTC](https://discuss.elastic.co/t/auditbeat-drop-events/127585/4 "2022-11-04T05:19:48Z")