# Drop "final" flow events

**URL:** <https://discuss.elastic.co/t/drop-final-flow-events/85596>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [May 12, 2017, 3:47pm UTC](https://discuss.elastic.co/t/drop-final-flow-events/85596 "2017-05-12T15:47:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rschirin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rschirin/32/45283_2.png) [@rschirin](https://discuss.elastic.co/u/rschirin)\
**Post date:** [May 12, 2017, 3:47pm UTC](https://discuss.elastic.co/t/drop-final-flow-events/85596/1 "2017-05-12T15:47:14Z")

</div>

Hi,  
I'm trying to use a processor to drop events when "final" = false (I have flows enabled).

I've tried these processors:

- drop\_event.when.equals.final: ["false"]
- drop\_event.when.equals.final: false
- drop\_event.when.equals.final: "false"

but no one of them work. I'm not understanding how to filter on boolean value.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [May 12, 2017, 3:59pm UTC](https://discuss.elastic.co/t/drop-final-flow-events/85596/2 "2017-05-12T15:59:51Z")

</div>

You can disable non-final flows by setting the [period](https://www.elastic.co/guide/en/beats/packetbeat/current/configuration-flows.html#_period) to `-1` (or might be `-1s`).

---

<div class="post-metadata">

**Author:** ![rschirin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rschirin/32/45283_2.png) [@rschirin](https://discuss.elastic.co/u/rschirin)\
**Post date:** [May 12, 2017, 4:33pm UTC](https://discuss.elastic.co/t/drop-final-flow-events/85596/3 "2017-05-12T16:33:47Z")

</div>

wow... there is really to much to learn.  
by the way, in the .yml template I found this comment:

> Configure reporting period. If set to -1, only killed flows will be reported

which is really clear. but, can you explain to me, for example, what does it mean if I set

`period: 10s`

value?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [May 12, 2017, 6:44pm UTC](https://discuss.elastic.co/t/drop-final-flow-events/85596/4 "2017-05-12T18:44:42Z")

</div>

When period is \>0 then you will get non-final events that give a summary of the flow up to that point in time.

BTW there is a new doc page for flows: [https://www.elastic.co/guide/en/beats/packetbeat/master/flows.html](https://www.elastic.co/guide/en/beats/packetbeat/master/flows.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 9, 2017, 6:50pm UTC](https://discuss.elastic.co/t/drop-final-flow-events/85596/5 "2017-06-09T18:50:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.