Hi @stephenb,
Apologies for any syntax issues there - The top two / originally posted configs had been modelled on those in this post which made use of the - as mine does.
I have amended to follow your example:
filebeat.autodiscover:
providers:
- type: docker
hints.enabled: true
processors:
- drop_event.when.contains.container.image.name: kibana
However as shown here that hasn't worked either (kibana feed following the most recent config edit)
You can see that the image / container names should be matching (or not matching for the httpd rule) but I'm getting all logs regardless of the config used.