# Auditbeat processor ignores drop\_event
**URL:** https://discuss.elastic.co/t/auditbeat-processor-ignores-drop-event/294917
**Category:** Beats
**Tags:** auditbeat
**Created:** [January 20, 2022, 9:18am UTC](https://discuss.elastic.co/t/auditbeat-processor-ignores-drop-event/294917 "2022-01-20T09:18:11Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@ziv1](https://discuss.elastic.co/u/ziv1)
#### Post date: [January 20, 2022, 9:18am UTC](https://discuss.elastic.co/t/auditbeat-processor-ignores-drop-event/294917/1 "2022-01-20T09:18:11Z")
Hi,
Trying to filter out some spam generated by auditbeat using a processor but it looks like, depending on how/where I set it up in the yml, it either completely ignores the processor, or stops processing events all together...
"auditbeat test config -c auditbeat.yml" says it's OK.
My processor:
```auto
processors:
- add_host_metadata: ~
- drop_event:
- when:
or:
- equals.process.name: "auditbeat"
- equals.event.action: "violated-seccomp-policy"
```
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [January 24, 2022, 2:28pm UTC](https://discuss.elastic.co/t/auditbeat-processor-ignores-drop-event/294917/2 "2022-01-24T14:28:47Z")
The indentation looks off. `or` should be nested under `when`.
```auto
processors:
- add_host_metadata:
- drop_event:
- when:
or:
- equals.process.name: auditbeat
- equals.event.action: violated-seccomp-policy
```
---
### Author:  [@ziv1](https://discuss.elastic.co/u/ziv1)
#### Post date: [January 25, 2022, 9:09am UTC](https://discuss.elastic.co/t/auditbeat-processor-ignores-drop-event/294917/3 "2022-01-25T09:09:03Z")
Hi,
This is also wrong. And I played with it to try many other things but no matter what I try I either completely stop getting any output (except heartbeat), or I get an error for the processor.
Also I should point out that different places specify a different syntax. (example: the guide, compared to your comment)
Which given how much of a special snowflake delicate little yaml is, doesn't help.
Are we sure processors actually work in AuditBeat ?
Edit:
Ok so after more messing around, I decided the thing I should have done from the start.
I simplified it to _just_ the one condition with the process.name, and wrote it EXACTLY like the example in _the guide_ (rather than the one here), and this _finally_ worked.
(I actually copy-pasted the thing and changed only the "http.code" part of the example)
Wow. my dislike for yaml is very strong.
Edit #2, for those interested from future-land, I did this:
```auto
processors:
- add_host_metadata: ~
- drop_event:
when:
equals:
process.name: auditbeat
```
This was enough to stop all the auditbeat records of itself (which were themselves the seccomp ones anyways so no second filter was requried for that)
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [January 25, 2022, 1:28pm UTC](https://discuss.elastic.co/t/auditbeat-processor-ignores-drop-event/294917/4 "2022-01-25T13:28:11Z")
I see the error in my previous post. I had made the contents of `drop_event` an array by including a `-` before the `when`.
```auto
processors:
- add_host_metadata:
- drop_event:
when:
or:
- equals.process.name: auditbeat
- equals.event.action: violated-seccomp-policy
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 22, 2022, 3:28pm UTC](https://discuss.elastic.co/t/auditbeat-processor-ignores-drop-event/294917/5 "2022-02-22T15:28:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.