# Drop\_event processor doesn't work

**URL:** <https://discuss.elastic.co/t/drop-event-processor-doesnt-work/206130>\
**Category:** Beats\
**Created:** [November 1, 2019, 8:11am UTC](https://discuss.elastic.co/t/drop-event-processor-doesnt-work/206130 "2019-11-01T08:11:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hlamsc](https://avatars.discourse-cdn.com/v4/letter/h/eb9ed0/32.png) [@hlamsc](https://discuss.elastic.co/u/hlamsc)\
**Post date:** [November 1, 2019, 8:11am UTC](https://discuss.elastic.co/t/drop-event-processor-doesnt-work/206130/1 "2019-11-01T08:11:26Z")

</div>

Hello,

I've a problem with my journalbeat config. I want to drop all events that have a syslog priority greater than 5 but nothing that has a process name with "nginx".

The config looks like this:

> ```
> processors:
> - drop_event:
> when:
> range:
> syslog.priority.gt: 5
> and.not.contains:
> process.name: "nginx"
> 
> ```

I've tried so many things but it just dont want to work. When I remove the processor the logs are received. The constellation with drop everything with a priority greater than 5 but not nginx logs are not working togehter as it seems.

What am I doing wrong here?

Edit:  
Ok I got a workaround with setting the facility of syslog in the nginx config. But it would be still interesting to know why my config above doesnt work

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [November 1, 2019, 1:50pm UTC](https://discuss.elastic.co/t/drop-event-processor-doesnt-work/206130/2 "2019-11-01T13:50:53Z")

</div>

What about trying

```auto
    processors:
        - drop_event:
            when:
              and:
                range:
                  syslog.priority.gt: 5
                not.contains:
                  process.name: "nginx"

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 29, 2019, 3:50pm UTC](https://discuss.elastic.co/t/drop-event-processor-doesnt-work/206130/3 "2019-11-29T15:50:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.