# Can't drop events from auditbeat
**URL:** https://discuss.elastic.co/t/cant-drop-events-from-auditbeat/288221
**Category:** Beats
**Tags:** auditbeat
**Created:** [November 2, 2021, 11:31am UTC](https://discuss.elastic.co/t/cant-drop-events-from-auditbeat/288221 "2021-11-02T11:31:59Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@sadux](https://discuss.elastic.co/u/sadux)
#### Post date: [November 2, 2021, 11:31am UTC](https://discuss.elastic.co/t/cant-drop-events-from-auditbeat/288221/1 "2021-11-02T11:31:59Z")
Hello! Just want to filter some useless logs from auditbeat. Try this config at auditbeat.yml:
```auto
- module: system
processors:
- drop_event:
when:
equals:
event.action: "network_flow"
- drop_event:
when:
equals:
event.action: "logged-in"
```
It succesfully drop "network\_flow" events, but I still received "logged-in" events. What am I doing wrong?
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [November 2, 2021, 4:29pm UTC](https://discuss.elastic.co/t/cant-drop-events-from-auditbeat/288221/2 "2021-11-02T16:29:13Z")
`"logged-in"` or `"logged_in"` ?
and is that the actual value in the `event.action` field?
Otherwise looks good, what happens if you reverse the order (which should not matter) or just use the 2nd `drop_event`.
You know sometimes I get tired of all the indents... this should work as well
```auto
processors:
- drop_event.when.equals.event.action: "network_flow"
```
---
### Author:  [@sadux](https://discuss.elastic.co/u/sadux)
#### Post date: [November 10, 2021, 10:52am UTC](https://discuss.elastic.co/t/cant-drop-events-from-auditbeat/288221/3 "2021-11-10T10:52:09Z")
Problem was with .yml syntax. proceessors block should begin from left side without space. It's work for me:
```auto
processors:
- drop_event:
when:
or:
- equals:
event.action: "negotiated-crypto-key"
- equals:
event.action: "disposed-credentials"
- equals:
event.action: "started-session"
- equals:
event.action: "acquired-credentials"
- equals:
event.action: "authenticated"
- equals:
event.action: "started-crypto-session"
- equals:
event.action: "was-authorized"
- equals:
event.action: "logged-in"
- equals:
event.action: "logged-out"
- equals:
event.action: "changed-login-id-to"
- equals:
event.action: "ended-session"
- equals:
event.action: "executed"
- equals:
event.action: "error"
- equals:
event.action: "refreshed-credentials"
- equals:
event.action: "opened-file"
- equals:
event.action: "existing_user"
- equals:
event.action: "existing_package"
- equals:
event.action: "loaded-firewall-rule-to"
- equals:
event.action: "violated-apparmor-policy"
- equals:
event.action: "violated-seccomp-policy"
- equals:
event.action: "changed-promiscuous-mode-on-device"
- equals:
event.action: "wrote-to-file"
- equals:
process.executable: "/usr/sbin/chronyd"
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 8, 2021, 12:53pm UTC](https://discuss.elastic.co/t/cant-drop-events-from-auditbeat/288221/4 "2021-12-08T12:53:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.