# Drop cdrom field

**URL:** <https://discuss.elastic.co/t/drop-cdrom-field/124636>\
**Category:** Logstash\
**Created:** [March 19, 2018, 8:04pm UTC](https://discuss.elastic.co/t/drop-cdrom-field/124636 "2018-03-19T20:04:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![clacko](https://avatars.discourse-cdn.com/v4/letter/c/ec9cab/32.png) [@clacko](https://discuss.elastic.co/u/clacko)\
**Post date:** [March 19, 2018, 8:04pm UTC](https://discuss.elastic.co/t/drop-cdrom-field/124636/1 "2018-03-19T20:04:11Z")

</div>

hi,  
trying to omit messages with system filesystem type of cdrom.  
My filter is as per below but seems to not work. They are still showing up in Kibana.

Any help would be appreciated.  
thanks

filter {  
if ([indexname] == "metricbeat-win" and [system.filesystem.type] == "cdrom" )  
{  
drop { }  
}  
}

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 3, 2018, 7:46am UTC](https://discuss.elastic.co/t/drop-cdrom-field/124636/2 "2018-04-03T07:46:15Z")

</div>

Question moved to #logstash

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 1, 2018, 7:46am UTC](https://discuss.elastic.co/t/drop-cdrom-field/124636/3 "2018-05-01T07:46:21Z")

</div>

Closed on May 1, 2018, 7:46am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.