# Drop event in heartbeat

**URL:** <https://discuss.elastic.co/t/drop-event-in-heartbeat/278096>\
**Category:** Beats\
**Tags:** heartbeat\
**Created:** [July 7, 2021, 4:37pm UTC](https://discuss.elastic.co/t/drop-event-in-heartbeat/278096 "2021-07-07T16:37:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![guimap](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guimap/32/90813_2.png) [@guimap](https://discuss.elastic.co/u/guimap)\
**Post date:** [July 7, 2021, 4:37pm UTC](https://discuss.elastic.co/t/drop-event-in-heartbeat/278096/1 "2021-07-07T16:37:05Z")

</div>

I would like drop event when namespace is different of "production"  
I'm using auto discover kubernetes into my `heartbeat.yml`

```auto
heartbeat.autodiscover:
 # Autodiscover services
 providers:
   - type: kubernetes
     resource: service
     scope: cluster
     node: ${NODE_NAME}
     hints.enabled: true
     processors:
      - drop_event.when:
          not.equals:
            kubernetes.namespace: "production"

kubernetes:
  namespace: production

output.elasticsearch:
  hosts: ['${ELASTICSEARCH_HOST:elasticsearch}:${ELASTICSEARCH_PORT:9200}']
  username: ${ELASTICSEARCH_USERNAME}
  password: ${ELASTICSEARCH_PASSWORD}

```

Into my service yaml added the elastic annotations:

```auto
annotations:
    co.elastic.monitor/type: http
    co.elastic.monitor/hosts: my-app.staging.svc.cluster.local:80/v1/status
    co.elastic.monitor/name: "my-app"
    co.elastic.monitor/schedule: "@every 1m"

```

I'm trying to use drop\_event processors, for drop event when kubernetes.namespace is different of production, but this doesnt work

```auto
heartbeat.autodiscover:
 # Autodiscover services
 providers:
   - type: kubernetes
     resource: service
     scope: cluster
     node: ${NODE_NAME}
     hints.enabled: true
     processors:
      - drop_event.when:
          not.equals:
            kubernetes.namespace: "production"

```

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [July 9, 2021, 9:16am UTC](https://discuss.elastic.co/t/drop-event-in-heartbeat/278096/2 "2021-07-09T09:16:05Z")

</div>

Did you try to put processors on the root level?

---

<div class="post-metadata">

**Author:** ![guimap](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guimap/32/90813_2.png) [@guimap](https://discuss.elastic.co/u/guimap)\
**Post date:** [July 12, 2021, 5:02pm UTC](https://discuss.elastic.co/t/drop-event-in-heartbeat/278096/3 "2021-07-12T17:02:02Z")

</div>

> [@guimap](#):
>
> ```auto
> heartbeat.autodiscover:
> # Autodiscover services
> providers:
> - type: kubernetes
> resource: service
> scope: cluster
> node: ${NODE_NAME}
> hints.enabled: true
> processors:
> - drop_event.when:
> not.equals:
> kubernetes.namespace: "production"
> 
> ```

like

```yml
processors:
  - drop_event.when:
      not.equals:
        kubernetes.namespace: "production"
heartbeat.autodiscover:
 # Autodiscover services
 providers:
   - type: kubernetes
     resource: service
     scope: cluster
     node: ${NODE_NAME}
     hints.enabled: true

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 9, 2021, 7:02pm UTC](https://discuss.elastic.co/t/drop-event-in-heartbeat/278096/4 "2021-08-09T19:02:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.