# Cannot drop\_event by system.syslog.program field

**URL:** <https://discuss.elastic.co/t/cannot-drop-event-by-system-syslog-program-field/172371>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 14, 2019, 3:31pm UTC](https://discuss.elastic.co/t/cannot-drop-event-by-system-syslog-program-field/172371 "2019-03-14T15:31:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![arustleund](https://avatars.discourse-cdn.com/v4/letter/a/c6cbf5/32.png) [@arustleund](https://discuss.elastic.co/u/arustleund)\
**Post date:** [March 14, 2019, 3:31pm UTC](https://discuss.elastic.co/t/cannot-drop-event-by-system-syslog-program-field/172371/1 "2019-03-14T15:31:11Z")

</div>

Version: filebeat-6.6.2-darwin-x86\_64

I am attempting to drop events from Filebeat using a processor. I have the system module enabled and I would like to drop events using conditions matching fields from the system module, but I haven't been able to get it to work yet. I was wondering if anyone had an idea of what I'm doing wrong. Here is the processors section of my filebeat.yml file:

```
processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - drop_event:
      when:
        not:
          contains:
            system.syslog.program: "diagnosticd"

```

This seems to filter all events, even though some contain the program name "diagnosticd". The only way I've gotten drop\_event to work is by using the field name "message", which seems to filter by the system.syslog.message field. However, using "program" as the field name does not seem to work either.

Any help would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [March 15, 2019, 2:07pm UTC](https://discuss.elastic.co/t/cannot-drop-event-by-system-syslog-program-field/172371/2 "2019-03-15T14:07:56Z")

</div>

Filebeat modules do not parse the contents in filebeat, but via Ingest Node in Elasticsearch. The raw events have no `system.syslog` fields yet, but only a `message` field with the original raw log line. Either you filter on `message` as you already do, or you adapt the ingest node pipeline in `module/system/syslog/ingest/` to drop an event. In the later case the event will still be send, but dropped later, though.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 12, 2019, 2:08pm UTC](https://discuss.elastic.co/t/cannot-drop-event-by-system-syslog-program-field/172371/3 "2019-04-12T14:08:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.