# Drop filter erros

**URL:** <https://discuss.elastic.co/t/drop-filter-erros/361364>\
**Category:** Logstash\
**Created:** [June 13, 2024, 12:26am UTC](https://discuss.elastic.co/t/drop-filter-erros/361364 "2024-06-13T00:26:39Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Honestabe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/honestabe/32/122763_2.png) [@Honestabe](https://discuss.elastic.co/u/Honestabe)\
**Post date:** [June 13, 2024, 12:26am UTC](https://discuss.elastic.co/t/drop-filter-erros/361364/1 "2024-06-13T00:26:39Z")

</div>

I am using the dissect filter to ingest csv files into elastic  
I used the drop filter to eliminate the headers.

```auto
filter {
       if [Email] == "Email" { drop{} }
}

```

but when I look at the index there where still documents with the Email as keyword.

that should not be possible since it they should be dropped(which most where).

when I locked at the json ths is twhat it shows

```auto
  "_source": {
    "Email": "Email\r",

```

I tried

```auto
filter {
       if [Email] == "Email\r" { drop{} }
}

```

but no luck.

also

```auto
filter {
       if [Email] == "Email\r" { drop{} }
}

```

but there is one doc that still shows up.  
any help would be great

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 13, 2024, 1:41am UTC](https://discuss.elastic.co/t/drop-filter-erros/361364/2 "2024-06-13T01:41:14Z")

</div>

> [@Honestabe](#):
>
> `if [Email] == "Email\r"`

That would match the string "Email+backslash+r". You do not have that, you have "Email+CR" (carriage return). You have options

1. Set config.support\_escapes in [logstash.yml](https://www.elastic.co/guide/en/logstash/current/logstash-settings-file.html), but beware this is global so it might affect other parts of your pipeline. \r will then be treated as a literal CR

2. Do a regexp match, where I think \r will match a CR.

3. I had a third option but it slips my mind right now....

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [June 13, 2024, 11:46am UTC](https://discuss.elastic.co/t/drop-filter-erros/361364/3 "2024-06-13T11:46:43Z")

</div>

Perhaps the 3rd option is

```auto
mutate
    {
        gsub => ['message',"\r", '']
        gsub => ['message',"\r\n", '']
    }

if [Email] == "Email" { drop {} }

```

However 2nd is the most suitable = regex.

---

<div class="post-metadata">

**Author:** ![Honestabe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/honestabe/32/122763_2.png) [@Honestabe](https://discuss.elastic.co/u/Honestabe)\
**Post date:** [June 13, 2024, 8:53pm UTC](https://discuss.elastic.co/t/drop-filter-erros/361364/4 "2024-06-13T20:53:53Z")

</div>

that worked.  
also that last section should have been

```auto
filter {
       if [tags] == "_dissectfailure" { drop{} }
}

```

it should drop all rows that generate this tag but there is still one in the index.

---

<div class="post-metadata">

**Author:** ![Honestabe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/honestabe/32/122763_2.png) [@Honestabe](https://discuss.elastic.co/u/Honestabe)\
**Post date:** [June 13, 2024, 9:26pm UTC](https://discuss.elastic.co/t/drop-filter-erros/361364/5 "2024-06-13T21:26:27Z")

</div>

also is there a way to mutate all the CR's

I noticed that all multiple rows have them

also i noticed one doc with

![image](https://us1.discourse-cdn.com/elastic/original/3X/5/0/50623d04d90aa3db7fc30f93adc2b5c265177718.png)

that got indext. do you know what the dimond ? is and how to get rid of it?

I tried to copy and paste it but it got rid of the question mark

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [June 14, 2024, 11:24am UTC](https://discuss.elastic.co/t/drop-filter-erros/361364/6 "2024-06-14T11:24:49Z")

</div>

> [@Honestabe](#):
>
> `if [tags] == "_dissectfailure" { drop{} }`

Change to:  
`if "_dissectfailure" in [tags] { drop{} }`

> [@Honestabe](#):
>
> how to get rid of it?

Try with:

```auto
mutate
    { gsub => ['email',"<put your spec>", ""] } 

```

If is not working, then use regex someting like: `^.` - for any 1st character or perhaps: `^\W` , not sure what is a content of the email field.