I am trying to config elastic-agent.yml to drop some events using processors but not filtering occures. Please advise:
- type: windows/metrics
data_stream.namespace: default
use_output: default
period: 60s
streams:- metricset: service
data_stream.dataset: windows.service
data_stream.type: metrics
processors: - drop_event.when.not.or:
- contains.windows.service.display_name: NAME1
- contains.windows.service.display_name: NAME3
- contains.windows.service.display_name: NAME2
- metricset: service