Drop_event proccessor

Elastic Stack Beats
1

Hello All,
i have an issue with filebeat.
I tried to "drop_event" with response code "200" and it's not working for me.

this is my filebeat configuration:

  processors:
    - drop_event:
        when:
          equals:
            http.response.code: 200

thakns for your help!

2

So do you have a sample of the Filebeat event? Is the code value a number or a string? Your filter is comparing against a number. If the value is a string then add some quotes to the config ("200").

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.