Version: filebeat-6.6.2-darwin-x86_64 I am attempting to drop events from Filebeat using a processor. I have the system module enabled and I would like to drop events using conditions matching fields from the system module, but I haven't been able to get it to work yet. I was wondering if anyone ha…

Filebeat modules do not parse the contents in filebeat, but via Ingest Node in Elasticsearch. The raw events have no system.syslog fields yet, but only a message field with the original raw log line. Either you filter on message as you already do, or you adapt the ingest node pipeline in module/syst…

Discuss the Elastic Stack

Cannot drop_event by system.syslog.program field

Elastic Stack Beats

system (system) Closed April 12, 2019, 2:08pm 3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Filebeat drop_event Beats filebeat	2	4013	July 5, 2017
How to drop events only from specific module Beats filebeat	9	1059	December 2, 2020
Filebeat drop_event module input Beats filebeat	4	927	November 25, 2020
Can't drop events from metricbeat Beats metricbeat	10	2539	August 28, 2017
"Drop_event" does not work Beats metricbeat	5	1261	November 29, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Cannot drop_event by system.syslog.program field

Related topics