# Auditbeat Exclusion of Process

**URL:** <https://discuss.elastic.co/t/auditbeat-exclusion-of-process/384243>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [December 24, 2025, 9:25am UTC](https://discuss.elastic.co/t/auditbeat-exclusion-of-process/384243 "2025-12-24T09:25:03Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [December 24, 2025, 10:18am UTC](https://discuss.elastic.co/t/auditbeat-exclusion-of-process/384243/2 "2025-12-24T10:18:32Z")

</div>

Hello @testtest

Welcome to the Community!!

We can use drop\_event in the yaml :

> **[auditbeat.reference.yml | Auditbeat Reference \[8.19\] | Elastic](https://www.elastic.co/guide/en/beats/auditbeat/8.19/auditbeat-reference-yml.html)**

Example :

> [@Auditbeat 7.3: Как добавить исключение auditd](https://discuss.elastic.co/t/auditbeat-7-3-auditd/205874/3):
>
> Игорь, спасибо за идею. Добавил процессор, но получил ошибку: Но и тут я получил ошибку: "Exiting: error initializing processors: each processor must have exactly one action, but found 2 actions (drop\_event,when)"

Thanks!!

---

_[View the full topic](https://discuss.elastic.co/t/auditbeat-exclusion-of-process/384243)._