# Drop\_event when up is false

**URL:** <https://discuss.elastic.co/t/drop-event-when-up-is-false/92046>\
**Category:** Beats\
**Tags:** heartbeat\
**Created:** [July 6, 2017, 8:22am UTC](https://discuss.elastic.co/t/drop-event-when-up-is-false/92046 "2017-07-06T08:22:43Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![alkuzad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alkuzad/32/19816_2.png) [@alkuzad](https://discuss.elastic.co/u/alkuzad)\
**Post date:** [July 6, 2017, 8:22am UTC](https://discuss.elastic.co/t/drop-event-when-up-is-false/92046/1 "2017-07-06T08:22:43Z")

</div>

I can't get drop\_event to work with up field.

I'm using heartbeat version 5.4.3

Up is simple boolean field and it seems equals condition do not support booleans. So neither "false" or "False" or 0, 1 works. Range filter does not work either.

How to create processor that drop events when service is running normally ?

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [July 6, 2017, 9:02am UTC](https://discuss.elastic.co/t/drop-event-when-up-is-false/92046/2 "2017-07-06T09:02:57Z")

</div>

Can you please share the settings you are using? It should help others to analyze what may be wrong 🙂

---

<div class="post-metadata">

**Author:** ![alkuzad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alkuzad/32/19816_2.png) [@alkuzad](https://discuss.elastic.co/u/alkuzad)\
**Post date:** [July 6, 2017, 9:54am UTC](https://discuss.elastic.co/t/drop-event-when-up-is-false/92046/3 "2017-07-06T09:54:36Z")

</div>

```auto
heartbeat.monitors:
- type: http
  schedule: '@every 2m'
  urls: ["http://service.example.com"]
  check.response.status: 200
heartbeat.scheduler:
  limit: 25
output.logstash:
  hosts: ["logstash.example.com:5044"]
processors:
 - drop_event:
     when:
      XXX

```

Where XXX is one of:

```auto
equals: 
  up: False

```

```auto
equals: 
  up: false

```

```auto
equals: 
  up: "false"

```

```auto
equals:
  up: 0

```

```auto
equals:
  up: 1

```

```auto
range:
 up:
  gt: 0

```

```auto
range:
 up:
  lt: 1

```

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [July 6, 2017, 3:45pm UTC](https://discuss.elastic.co/t/drop-event-when-up-is-false/92046/4 "2017-07-06T15:45:30Z")

</div>

This looks like a bug due to the `equals` condition not supporting booleans. Please open an issue on Github.

This is the part of the code doing the check and it only supports int and string. [https://github.com/elastic/beats/blob/5ddd68527bd3335b0c450549f6b7d80c0f5cf86e/libbeat/processors/condition.go#L252-L266](https://github.com/elastic/beats/blob/5ddd68527bd3335b0c450549f6b7d80c0f5cf86e/libbeat/processors/condition.go#L252-L266)

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [July 7, 2017, 2:02pm UTC](https://discuss.elastic.co/t/drop-event-when-up-is-false/92046/5 "2017-07-07T14:02:45Z")

</div>

Note: For beats 6.0 release the heartbeat event format is going to be changed (more normalized with other beats): [https://github.com/elastic/beats/pull/4091](https://github.com/elastic/beats/pull/4091)

This change should be already included in the 6.0 alpha2 release.

The boolean `up` field has been replaced with `monitor.status` of type string (currently 'up' or 'down').

---

<div class="post-metadata">

**Author:** ![alkuzad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alkuzad/32/19816_2.png) [@alkuzad](https://discuss.elastic.co/u/alkuzad)\
**Post date:** [July 10, 2017, 8:44am UTC](https://discuss.elastic.co/t/drop-event-when-up-is-false/92046/6 "2017-07-10T08:44:46Z")

</div>

@andrewkroh thanks for finding specific code for that 🙂 I've opened issue: [https://github.com/elastic/beats/issues/4637](https://github.com/elastic/beats/issues/4637)

@steffens nice, we are experimenting with Heartbeat as it can be fully configured directly in AWS CloudFormation, without using a lot of hacks. Unfortunately my team is too small now to start experimenting with 6.0 when we are still in 2.4 after lots of changes made to get rid of buggy 1.7 (when we had to patch logstash plugins for a while because it was easier than upgrade)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 7, 2017, 8:45am UTC](https://discuss.elastic.co/t/drop-event-when-up-is-false/92046/7 "2017-08-07T08:45:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.