Hi All, Could someone help me with exclude any process executable related to this path /usr/local/manageengine/uems_agent/bin/* (I can see a lot of incoming logs related to /usr/local/manageengine/uems_agent/bin/dcpatchscan /usr/local/manageengine/uems_agent/bin/dcconfig /usr/local/manageengin…

Discuss the Elastic Stack

Auditbeat Exclusion of Process

Elastic Stack Beats

Tortoise December 24, 2025, 10:18am 2

Hello @testtest

Welcome to the Community!!

We can use drop_event in the yaml :

Example :

Thanks!!

Topic		Replies	Views
Auditbeat 7.3: Как добавить исключение auditd Вопросы на русском языке	5	986	November 27, 2019
Dropping events in Auditbeat Beats auditbeat	5	1031	April 16, 2020
Auditbeat processor ignores drop_event Beats auditbeat	4	594	February 22, 2022
[Auditbeat 7.6 - 7.2] Processor not working Beats auditbeat	1	371	March 25, 2020
Can't drop events from auditbeat Beats auditbeat	3	771	December 8, 2021

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Auditbeat Exclusion of Process

Related topics