# Drop events from metricbeat is not working

**URL:** <https://discuss.elastic.co/t/drop-events-from-metricbeat-is-not-working/281208>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [August 12, 2021, 1:32pm UTC](https://discuss.elastic.co/t/drop-events-from-metricbeat-is-not-working/281208 "2021-08-12T13:32:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![fpsouza](https://avatars.discourse-cdn.com/v4/letter/f/b782af/32.png) [@fpsouza](https://discuss.elastic.co/u/fpsouza)\
**Post date:** [August 12, 2021, 1:32pm UTC](https://discuss.elastic.co/t/drop-events-from-metricbeat-is-not-working/281208/1 "2021-08-12T13:32:27Z")

</div>

Hello Folks, as you can see below, I'm not being able to drop event when doesn't have "system".  
Could u please let me know if if is possible to do that?  
I really appreciate your help and time

processors:

- **drop\_event.when:**  
**not:**  
**has\_fields: ['system']**

Follow below output  
"@timestamp": "2021-08-12T12:23:49.480Z",  
"@metadata": {  
"beat": "metricbeat",  
"type": "\_doc",  
"version": "7.10.0"  
},  
"agent": {  
"version": "7.10.0",  
"hostname": "_**",  
"ephemeral\_id": "",  
"id": "",  
"name": "**_",  
"type": "metricbeat"  
},  
"event": {  
"dataset": "system.diskio",  
"module": "system"  
},  
"metricset": {  
"name": "diskio",  
"period": 60000  
},  
"service": {  
"type": "system"  
},  
"system": {  
"diskio": {  
"name": "C:",  
"read": {  
"bytes": 66803812352,  
"count": 3052351,  
"time": 6042921  
},  
"write": {  
"count": 6426107,  
"time": 17749385,  
"bytes": 168764028416  
}  
}  
},  
"fields": {  
"uuid": "\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*"  
},  
"ecs": {  
"version": "1.6.0"  
},  
"host": {  
"name": "\*\*\*\*\*\*\*\*\*\*\*\*\*\*"  
},  
"tag": "metricbeat",  
"customer\_id": "3"  
}

---

<div class="post-metadata">

**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\
**Post date:** [August 12, 2021, 1:38pm UTC](https://discuss.elastic.co/t/drop-events-from-metricbeat-is-not-working/281208/2 "2021-08-12T13:38:30Z")

</div>

Hi,

have you tried [system][network][name] ? how is this field parsed ?

---

<div class="post-metadata">

**Author:** ![fpsouza](https://avatars.discourse-cdn.com/v4/letter/f/b782af/32.png) [@fpsouza](https://discuss.elastic.co/u/fpsouza)\
**Post date:** [August 12, 2021, 1:51pm UTC](https://discuss.elastic.co/t/drop-events-from-metricbeat-is-not-working/281208/4 "2021-08-12T13:51:42Z")

</div>

Hi, the drop event is not working is below

drop\_event.when:  
not:  
has\_fields: ['system']

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 9, 2021, 3:52pm UTC](https://discuss.elastic.co/t/drop-events-from-metricbeat-is-not-working/281208/5 "2021-09-09T15:52:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.