# Drop\_event config issue

**URL:** <https://discuss.elastic.co/t/drop-event-config-issue/77405>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [March 4, 2017, 11:48pm UTC](https://discuss.elastic.co/t/drop-event-config-issue/77405 "2017-03-04T23:48:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rherr63](https://avatars.discourse-cdn.com/v4/letter/r/ccd318/32.png) [@rherr63](https://discuss.elastic.co/u/rherr63)\
**Post date:** [March 4, 2017, 11:48pm UTC](https://discuss.elastic.co/t/drop-event-config-issue/77405/1 "2017-03-04T23:48:54Z")

</div>

I found a similar issue to what I am dealing with and tried the filters solution but still not able to start Metricbeat successfully. I reviewed [Processors drop\_event - no worky](https://discuss.elastic.co/t/processors-drop-event-no-worky/70970/3) and tried to use both filter and processors but neither worked. Like the previous user, I am also trying to exclude all but a few of the mount\_points for inclusion in filesystem metrics. I am unable to include the full config but this is everything except the output config:

```auto
#========================== Modules configuration ============================
metricbeat.modules:
#------------------------------- System Module -------------------------------
- module: system
  metricsets:
    # CPU stats
    - cpu
    # System Load stats
    - load
    # Per filesystem stats
    - filesystem
    # Per process stats
    - process
  enabled: true
  period: 30s
  processes: ['.*']
  filters:
    - drop_event:
        when:
            - regexp:
                mount_point: '^/(sys|cgroup|proc|dev)'
 processors:
 - drop_fields:
     fields: ['metricset.rtt']

```

One difference from referenced topic is i also include the 'processors:' section immediately below the 'filters' section. Is this a problem?

I noticed the author of the topic above also has the following two lines at the end. What are the function of these and is this what I am missing?

```auto
  - regexp:
                device_name: '^10.69.69'
            - equals:
                device_name: sunrpc

```

Thanks in advance,  
RHerring

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 9, 2017, 10:13pm UTC](https://discuss.elastic.co/t/drop-event-config-issue/77405/2 "2017-03-09T22:13:31Z")

</div>

There is a concrete example of filesystem filtering in the [documentation](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metricset-system-filesystem.html#_filtering).

```auto
metricbeat.modules:
  - module: system
    period: 30s
    metricsets: ["filesystem"]
    filters:
      - drop_event.when.regexp.mount_point: '^/(sys|cgroup|proc|dev|etc|host)($|/)'

```

which is effectively the same as this:

```auto
metricbeat.modules:
  - module: system
    period: 30s
    metricsets: ["filesystem"]
    filters:
      - drop_event:
          when:
            regexp:
              mount_point: '^/(sys|cgroup|proc|dev|etc|host)($|/)'

```

> [@rherr63](#):
>
> I noticed the author of the topic above also has the following two lines at the end. What are the function of these and is this what I am missing?

It looks like that user added a few extra conditions to their filter to drop specific devices based on name.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 6, 2017, 10:13pm UTC](https://discuss.elastic.co/t/drop-event-config-issue/77405/3 "2017-04-06T22:13:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.