# Drop event processor not working **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [February 21, 2022, 7:51am UTC](https://discuss.elastic.co/t/drop-event-processor-not-working/297720 "2022-02-21T07:51:09Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![cd-t1-361](https://avatars.discourse-cdn.com/v4/letter/c/71e660/32.png) [@cd-t1-361](https://discuss.elastic.co/u/cd-t1-361)\ **Post date:** [February 21, 2022, 7:51am UTC](https://discuss.elastic.co/t/drop-event-processor-not-working/297720/1 "2022-02-21T07:51:09Z")
I'm wanting to exclude a particular event if the eventdata contains X value. I've also tried dropping based on just the event id, but for some reason i'm unable to get the event to get dropped & is still being processed. I've appended the log below also.. ```auto - name: Microsoft-Windows-FailoverClustering/Operational processors: - drop_event.when.or: - contains.event_data: 'RegCheckpoint::SaveCheckpoint' - equals.event_id: 2051 ``` The xml data for the event is this: ```auto - - 2051 0 2 0 0 0x2000000000000000 137081 Microsoft-Windows-FailoverClustering/Diagnostic computername - [CM] mscs::RegCheckpoint::SaveCheckpoint: (1018)' because of '::RegSaveKeyEx(handle, file.c_str(), nullptr, options)' ``` winlogbeat log ```auto 2022-02-21T18:44:54.691+1100 INFO instance/beat.go:611 Home path: [C:\admin\tools] Config path: [C:\admin\tools] Data path: [C:\admin\tools\data] Logs path: [C:\admin\tools\logs] 2022-02-21T18:44:54.692+1100 INFO instance/beat.go:618 Beat UUID: UID 2022-02-21T18:44:54.693+1100 INFO [beat] instance/beat.go:931 Beat info {"system_info": {"beat": {"path": {"config": "C:\\admin\\tools", "data": "C:\\admin\\tools\\data", "home": "C:\\admin\\tools", "logs": "C:\\admin\\tools\\logs"}, "type": "winlogbeat", "uuid": "uuid"}}} 2022-02-21T18:44:54.693+1100 INFO [beat] instance/beat.go:940 Build info {"system_info": {"build": {"commit": "unknown", "libbeat": "6.8.2", "time": "1754-08-30T22:43:41.128Z", "version": "6.8.2"}}} 2022-02-21T18:44:54.693+1100 INFO [beat] instance/beat.go:943 Go runtime info {"system_info": {"go": {"os":"windows","arch":"amd64","max_procs":4,"version":"go1.10.6"}}} 2022-02-21T18:44:54.707+1100 INFO [beat] instance/beat.go:947 Host info {"system_info": {"host": {"architecture":"x86_64","boot_time":"2022-02-21T14:49:45.56+11:00","name":"computername","ip":["IP ADDRESS"],"kernel_version":"10.0.17763.2565 (WinBuild.160101.0800)","MAC ADDRESS":["x"],"os":{"family":"windows","platform":"windows","name":"Windows Server 2019 Datacenter","version":"10.0","major":10,"minor":0,"patch":0,"build":"17763.2565"},"timezone":"AEDT","timezone_offset_sec":39600,"id":"id"}}} 2022-02-21T18:44:54.713+1100 INFO [beat] instance/beat.go:976 Process info {"system_info": {"process": {"cwd": "C:\\admin\\tools", "exe": "C:\\admin\\tools\\winlogbeat.exe", "name": "winlogbeat.exe", "pid": 7792, "ppid": 9212, "start_time": "2022-02-21T18:44:54.204+1100"}}} 2022-02-21T18:44:54.714+1100 INFO instance/beat.go:280 Setup Beat: winlogbeat; Version: 6.8.2 2022-02-21T18:44:54.717+1100 INFO add_cloud_metadata/add_cloud_metadata.go:345 add_cloud_metadata: hosting provider type detected as ec2, metadata={"availability_zone":"region","instance_id":"instance_id","machine_type":"r5d.xlarge","provider":"ec2","region":"region"} 2022-02-21T18:44:54.718+1100 DEBUG [processors] processors/processor.go:66 Processors: add_cloud_metadata={"availability_zone":"ap-southeast-2a","instance_id":"instance_id","machine_type":"r5d.xlarge","provider":"ec2","region":"region"} 2022-02-21T18:44:54.718+1100 INFO kinesis/kinesis.go:89 Kinesis output - stream set to: x 2022-02-21T18:44:54.719+1100 INFO kinesis/kinesis.go:100 Kinesis output - using AWS credentials from EC2 role. 2022-02-21T18:44:54.723+1100 INFO kinesis/kinesis.go:115 Kinesis output - using AWS region: AWS-Region 2022-02-21T18:44:54.723+1100 INFO kinesis/kinesis.go:122 Kinesis output - assuming AWS role: arn:aws:iam::x 2022-02-21T18:44:54.724+1100 INFO [publisher] pipeline/module.go:110 Beat name: computername 2022-02-21T18:44:54.724+1100 INFO beater/winlogbeat.go:68 State will be read from and persisted to C:\admin\tools\data\.winlogbeat.yml 2022-02-21T18:44:54.724+1100 DEBUG [processors] processors/processor.go:66 Processors: 2022-02-21T18:44:54.725+1100 DEBUG [processors] processors/processor.go:66 Processors: 2022-02-21T18:44:54.725+1100 DEBUG [processors] processors/processor.go:66 Processors: 2022-02-21T18:44:54.725+1100 DEBUG [processors] processors/processor.go:66 Processors: 2022-02-21T18:44:54.725+1100 DEBUG [processors] processors/processor.go:66 Processors: 2022-02-21T18:44:54.726+1100 DEBUG [processors] conditions/conditions.go:93 New condition equals: map[event_id:{2051 false}] 2022-02-21T18:44:54.726+1100 DEBUG [processors] conditions/conditions.go:93 New condition equals: map[event_id:{2051 false}] 2022-02-21T18:44:54.726+1100 DEBUG [processors] processors/processor.go:66 Processors: drop_event, condition=equals: map[event_id:{2051 false}] 2022-02-21T18:44:54.726+1100 DEBUG [processors] processors/processor.go:66 Processors: 2022-02-21T18:44:54.727+1100 DEBUG [processors] processors/processor.go:66 Processors: 2022-02-21T18:44:54.727+1100 DEBUG [processors] processors/processor.go:66 Processors: 2022-02-21T18:44:54.727+1100 INFO instance/beat.go:402 winlogbeat start running. 2022-02-21T18:44:54.727+1100 INFO [monitoring] log/log.go:117 Starting metrics logging every 30s 2022-02-21T18:44:54.743+1100 WARN beater/eventlogger.go:104 EventLog[TechnologyOne] Open() error. No events will be read from this source. The specified channel could not be found. 2022-02-21T18:44:55.765+1100 INFO kinesis/kinesis.go:141 Kinesis output - Processing batch of 18 events 2022-02-21T18:44:56.658+1100 INFO beater/eventlogger.go:73 EventLog[Microsoft-Windows-FailoverClustering/Diagnostic] successfully published 18 events 2022-02-21T18:44:56.773+1100 INFO kinesis/kinesis.go:141 Kinesis output - Processing batch of 6 events 2022-02-21T18:44:56.789+1100 INFO beater/eventlogger.go:73 EventLog[Microsoft-Windows-FailoverClustering/Diagnostic] successfully published 6 events 2022-02-21T18:44:57.780+1100 INFO kinesis/kinesis.go:141 Kinesis output - Processing batch of 12 events 2022-02-21T18:44:57.796+1100 INFO beater/eventlogger.go:73 EventLog[Microsoft-Windows-FailoverClustering/Diagnostic] successfully published 12 events 2022-02-21T18:44:58.672+1100 INFO beater/winlogbeat.go:164 Stopping Winlogbeat 2022-02-21T18:44:58.748+1100 INFO beater/eventlogger.go:109 EventLog[Microsoft-Windows-FailoverClustering/Operational] Stop processing. 2022-02-21T18:44:58.748+1100 INFO beater/eventlogger.go:109 EventLog[Microsoft-Windows-FailoverClustering-Manager/Admin] Stop processing. 2022-02-21T18:44:58.749+1100 INFO beater/eventlogger.go:109 EventLog[Microsoft-Windows-TaskScheduler/Operational] Stop processing. 2022-02-21T18:44:58.751+1100 INFO beater/eventlogger.go:109 EventLog[Application] Stop processing. 2022-02-21T18:44:58.751+1100 INFO beater/eventlogger.go:109 EventLog[Microsoft-Windows-AppLocker/EXE and DLL] Stop processing. 2022-02-21T18:44:58.752+1100 INFO beater/eventlogger.go:109 EventLog[System] Stop processing. 2022-02-21T18:44:58.770+1100 INFO beater/eventlogger.go:109 EventLog[Security] Stop processing. 2022-02-21T18:44:58.782+1100 INFO beater/eventlogger.go:109 EventLog[Microsoft-Windows-FailoverClustering/Diagnostic] Stop processing. 2022-02-21T18:44:58.841+1100 INFO [monitoring] log/log.go:152 Total non-zero metrics {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":62,"time":{"ms":62}},"total":{"ticks":140,"time":{"ms":140},"value":140},"user":{"ticks":78,"time":{"ms":78}}},"handles":{"open":377},"info":{"ephemeral_id":"ephemeral_id","uptime":{"ms":4537}},"memstats":{"gc_next":5791984,"memory_alloc":2899728,"memory_total":7551672,"rss":27594752}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":36,"batches":3,"total":36},"type":"kinesis"},"pipeline":{"clients":0,"events":{"active":0,"published":36,"total":36},"queue":{"acked":36}}},"msg_file_cache":{"Microsoft-Windows-FailoverClustering/DiagnosticHits":35,"Microsoft-Windows-FailoverClustering/DiagnosticMisses":1,"Microsoft-Windows-FailoverClustering/DiagnosticSize":1},"published_events":{"Microsoft-Windows-FailoverClustering/Diagnostic":36,"total":36},"system":{"cpu":{"cores":4}}}}} 2022-02-21T18:44:58.842+1100 INFO [monitoring] log/log.go:153 Uptime: 4.5907757s 2022-02-21T18:44:58.844+1100 INFO [monitoring] log/log.go:130 Stopping metrics logging. 2022-02-21T18:44:58.844+1100 INFO instance/beat.go:412 winlogbeat stopped. ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 21, 2022, 9:51am UTC](https://discuss.elastic.co/t/drop-event-processor-not-working/297720/2 "2022-03-21T09:51:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.