# Drop Events works only for Linux

**URL:** <https://discuss.elastic.co/t/drop-events-works-only-for-linux/283263>\
**Category:** Beats\
**Tags:** docker, metricbeat\
**Created:** [September 3, 2021, 9:53am UTC](https://discuss.elastic.co/t/drop-events-works-only-for-linux/283263 "2021-09-03T09:53:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![fpsouza](https://avatars.discourse-cdn.com/v4/letter/f/b782af/32.png) [@fpsouza](https://discuss.elastic.co/u/fpsouza)\
**Post date:** [September 3, 2021, 9:53am UTC](https://discuss.elastic.co/t/drop-events-works-only-for-linux/283263/1 "2021-09-03T09:53:28Z")

</div>

Hello Sirs,  
Could you please let me know when my drop events below is only working for linux and not for windows platfom? Is tere something that should be difference in the metricbeat.yml file?

Follow my metricbeat.yml file for Linux ( **works fine** )

```auto
 - drop_event:
      when:
        or:
        - regexp:
            system.filesystem.mount_point: '^(/sys|/cgroup|/proc|/dev|/etc|/host|/run|/mnt/home|/var/lib/lxcfs|/var/lib/docker|/snap*)($|/)'
        - equals:
            system.network.name: 'lo'
        - regexp:
            system.diskio.name: "fd0|sr0"
        - not:
           has_fields: ['system']
  fields:
    uuid: ********************************

```

Follow my metricbeat.yml file for Linux ( **does NOT work** )

```auto
- drop_event:
      when:
        or:
        - equals:
            system.network.name: 'Loopback Pseudo-Interface 1'
        - not:
           has_fields: ['system']
  fields:
    uuid: *******************************

```

---

<div class="post-metadata">

**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\
**Post date:** [September 8, 2021, 6:51am UTC](https://discuss.elastic.co/t/drop-events-works-only-for-linux/283263/2 "2021-09-08T06:51:28Z")

</div>

Hi!

Do you see any errors or just the processor does not filter out the events in Windows? You can try to verify if in Windows you have the same conditions, does the conditions depends on a platform specific field?

C.

---

<div class="post-metadata">

**Author:** ![fpsouza](https://avatars.discourse-cdn.com/v4/letter/f/b782af/32.png) [@fpsouza](https://discuss.elastic.co/u/fpsouza)\
**Post date:** [September 9, 2021, 8:51am UTC](https://discuss.elastic.co/t/drop-events-works-only-for-linux/283263/3 "2021-09-09T08:51:32Z")

</div>

Hello, thete is any error, the processor doesn't filter out the events in windows.  
Regarding to your suggestion ( you can try to verify if in windows you have the same conditons)  
I'll set up the same conditions as linux and perform some tests on window machine.  
About your question (does the conditions depends on a platform specific field?)  
If you see in the windows conditional, we are drop network events that doesn't need to be set up in linux. So, I would say that yes

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 7, 2021, 10:51am UTC](https://discuss.elastic.co/t/drop-events-works-only-for-linux/283263/4 "2021-10-07T10:51:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.