Drop_event proccessor


(Asaf David) #1

Hello All,
i have an issue with filebeat.
I tried to "drop_event" with response code "200" and it's not working for me.

this is my filebeat configuration:

  processors:
    - drop_event:
        when:
          equals:
            http.response.code: 200 

thakns for your help!


(Andrew Kroh) #2

So do you have a sample of the Filebeat event? Is the code value a number or a string? Your filter is comparing against a number. If the value is a string then add some quotes to the config ("200").


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.