# Drop\_event processor not working

**URL:** <https://discuss.elastic.co/t/drop-event-processor-not-working/272786>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [May 12, 2021, 8:42am UTC](https://discuss.elastic.co/t/drop-event-processor-not-working/272786 "2021-05-12T08:42:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![borna\_talebi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/borna_talebi/32/76317_2.png) [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\
**Post date:** [May 12, 2021, 8:42am UTC](https://discuss.elastic.co/t/drop-event-processor-not-working/272786/1 "2021-05-12T08:42:59Z")

</div>

I have a proccessor to drop some events for a user. here is my config:

```auto
processors:
- drop_event:
    when:
      and:
      - or:
        - equals.event.code: 4658
        - equals.event.code: 4656
        - equals.event.code: 4634
        - equals.event.code: 4648
      - equals.event_data.SubjectUserName: "test-user$"

```

But it's not working. I've restarted the winlogbeat service too.  
I'm using ELK 7.9 with winlogbeat 7.2

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [May 12, 2021, 12:27pm UTC](https://discuss.elastic.co/t/drop-event-processor-not-working/272786/2 "2021-05-12T12:27:48Z")

</div>

> [@borna\_talebi](#):
>
> `equals.event_data.SubjectUserName`

Does `event_data.SubjectUserName` field exist in any events you have? I think it should be `winlog.event_data.SubjectUserName`.

---

<div class="post-metadata">

**Author:** ![borna\_talebi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/borna_talebi/32/76317_2.png) [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\
**Post date:** [May 12, 2021, 3:31pm UTC](https://discuss.elastic.co/t/drop-event-processor-not-working/272786/3 "2021-05-12T15:31:04Z")

</div>

> [@andrewkroh](#):
>
> winlog.event\_data.SubjectUserName

It's `winlog.event_data.SubjectUserName` in my config. just a typo here.  
I'm guessing the `$` at the end is causing the problem.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 9, 2021, 5:31pm UTC](https://discuss.elastic.co/t/drop-event-processor-not-working/272786/4 "2021-06-09T17:31:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.