There's nothing wrong with the filter. Perhaps you're not running with the configuration you expect?
$ cat test.config
input { stdin { } }
output { stdout { codec => rubydebug } }
filter {
if "ASA-6-302013" in [message] { drop{ } }
}
$ ( echo 'first message' ; echo 'Oct 27 12:43:28 asa10 : %ASA-6-302013: Built inbound TCP connection 1033541997 for outside:10.150.0.0./46742 (10.150.0.0/46742) to inside.customer:172.26.0.0/8080 (161.215.0.0/8080)' ; echo 'third message' ) | /opt/logstash/bin/logstash -f test.config
Settings: Default pipeline workers: 8
Pipeline main started
{
"message" => "first message",
"@version" => "1",
"@timestamp" => "2016-10-27T12:59:19.746Z",
"host" => "lnxolofon"
}
{
"message" => "third message",
"@version" => "1",
"@timestamp" => "2016-10-27T12:59:19.780Z",
"host" => "lnxolofon"
}
Pipeline main has been shutdown
stopping pipeline {:id=>"main"}