# Drop filter in Logstash filter not working for the below event

**URL:** <https://discuss.elastic.co/t/drop-filter-in-logstash-filter-not-working-for-the-below-event/343120>\
**Category:** Logstash\
**Created:** [September 15, 2023, 8:39am UTC](https://discuss.elastic.co/t/drop-filter-in-logstash-filter-not-working-for-the-below-event/343120 "2023-09-15T08:39:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Subrato1](https://avatars.discourse-cdn.com/v4/letter/s/ea5d25/32.png) [@Subrato1](https://discuss.elastic.co/u/Subrato1)\
**Post date:** [September 15, 2023, 8:39am UTC](https://discuss.elastic.co/t/drop-filter-in-logstash-filter-not-working-for-the-below-event/343120/1 "2023-09-15T08:39:21Z")

</div>

Event in Logstash :

```auto
{
      "timestamp" => "2023-09-13T05:10:52.527038098Z",
       "user" => "admin",
       "type" => "icd_postgresql",
       "status" => "INSERT INTO t1 SELECT i/100, i/500 FROM generate_series(1,1000000) s(i);",
      "ID1" => "00000",
      "@version" => "1",
      "accountId" => "2212c4a700f44505a917e8fcb952c4ce",
      "dbname" => "ibmclouddb",
      "detail" => ":b6abb2aa-ef85-494e-a174-12cd7223d9e7",
      "clientIP" => "172.30.12.192",
      "timezone" => "UTC",
      "statement" => "STATEMENT"
}

```

Filter for drop this event:

```auto
filter {
if [ID1] == "00000" and [statement] == "STATEMENT"
{
 drop {}
}
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 15, 2023, 6:31pm UTC](https://discuss.elastic.co/t/drop-filter-in-logstash-filter-not-working-for-the-below-event/343120/2 "2023-09-15T18:31:11Z")

</div>

That conditional drop works for me. Maybe your event does not look the way you think it does.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 13, 2023, 6:31pm UTC](https://discuss.elastic.co/t/drop-filter-in-logstash-filter-not-working-for-the-below-event/343120/3 "2023-10-13T18:31:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.