"Drop_event" does not work

Elastic Stack Beats
1

Hello
I have a filter in my metricbeat.yml,part of the config file like this:

- module: system
  metricsets: [network]
  enabled: true
  filters:
    - drop_event.when.equals.system.network.name: lo

I want to drop the event named "lo" ,but it does not work .I can get the data from "lo" device via kibana and contines to grow.

Can you help me please
best regards.

2

Hi @AmosChen,

What version of Metricbeat are you using? Try changing filters to processors

3

Thank you so much for your reply.
The version of Metricbeat is 5.6.2.
According to your suggestion，the filters was changed by processors,but it is still useless，anticipates your reply。

best regards.

4

Could you please paste the resulting config? This is something we ship by default and so far it works:

5

Hi @exekias
I have solved this problem using your tips .The reference documentation: The filter setting in metricbeat 5.x is applied on the non-finalized event. You have to access the keys by it’s local name. For example the mount_point its full name is system.filesystem.mount_point. The local name of system.network.name is just name. so I replace 'system.network.name' with 'name', the filter does work.It seems like that

  • module: system
    metricsets: [network]
    enabled: true
    filters:
    • drop_event:
      when:
      - equals:
      name: lo

thanks.:grinning:

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.