# Drop network events

**URL:** <https://discuss.elastic.co/t/drop-network-events/98032>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [August 23, 2017, 8:38am UTC](https://discuss.elastic.co/t/drop-network-events/98032 "2017-08-23T08:38:33Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![muratungor](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@muratungor](https://discuss.elastic.co/u/muratungor)\
**Post date:** [August 23, 2017, 8:38am UTC](https://discuss.elastic.co/t/drop-network-events/98032/1 "2017-08-23T08:38:33Z")

</div>

Hello  
I have 2 filter in my metricbeat.yml

> Blockquote  
> filters:  
> drop\_event.when.equals.system.network.name: lo  
> drop\_event.when.regexp.mount\_point: '^/(automnt|tmp|boot|net|misc|/var/lib|sys|cgroup|proc|dev|etc|host|run)($|/)'

second filter (mount\_point) is working but system.network.name: lo filter is not working.  
Can you help me please  
best regards

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [August 23, 2017, 11:42am UTC](https://discuss.elastic.co/t/drop-network-events/98032/2 "2017-08-23T11:42:36Z")

</div>

Please use the `</>` button to format configuration files. This will preserve whitespace.

The filter setting in metricbeat 5.x is applied on the non-finalized event. You have to access the keys by it's local name. For example the `mount_point` its full name is `system.filesystem.mount_point`. The local name of `system.network.name` is just `name`. When moving the filters to the global scope (`processors` setting), you will operate on the full event.

With metricbeat 6.0 beta1, we replaced the local `filter` setting with a local `processors` setting. The new setting operates on the complete event and requires you to use `system.network.name` and `system.filesystem.mount_point`. This helps resolving ambiguities.

---

<div class="post-metadata">

**Author:** ![muratungor](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@muratungor](https://discuss.elastic.co/u/muratungor)\
**Post date:** [August 23, 2017, 11:54am UTC](https://discuss.elastic.co/t/drop-network-events/98032/3 "2017-08-23T11:54:47Z")

</div>

Hello Steffens  
We're using metricbeat 5.5.2-1 . I've changed key to local name. You can find the configuration file below. But still I can see the lo interface events

\< - module: system  
metricsets:  
# CPU stats  
- cpu

```
# System Load stats
- load

# Per CPU core stats
#- core

# IO stats
- diskio

# Per filesystem stats
- filesystem

# File system summary stats
#- fsstat

# Memory stats
- memory

# Network stats
- network

# Per process stats
#- process

# Sockets (linux only)
#- socket
enabled: true
period: 60s
processes: ['.*']
filters:
 drop_event.when.equals.name: lo
 drop_event.when.regexp.mount_point: '^/(automnt|tmp|boot|net|misc|/var/lib|sys|cgroup|proc|dev|etc|host|run)($|/)'

```

/\>

---

<div class="post-metadata">

**Author:** ![muratungor](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@muratungor](https://discuss.elastic.co/u/muratungor)\
**Post date:** [August 24, 2017, 6:54am UTC](https://discuss.elastic.co/t/drop-network-events/98032/4 "2017-08-24T06:54:36Z")

</div>

Hello  
It's work with regexp. now it seems like below

```
  enabled: true
  period: 60s
  processes: ['.*']
  filters:
    - drop_event.when.equals.device_name: sunrpc
    - drop_event.when.regexp.mount_point: '^/(automnt|tmp|boot|net|misc|sys|cgroup|proc|dev|etc|host|run)($|/)'
    - drop_event.when.regexp.name: '^lo'
```

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [August 24, 2017, 3:02pm UTC](https://discuss.elastic.co/t/drop-network-events/98032/5 "2017-08-24T15:02:42Z")

</div>

Is your network device named `lo` or something like `lo0`?

---

<div class="post-metadata">

**Author:** ![muratungor](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@muratungor](https://discuss.elastic.co/u/muratungor)\
**Post date:** [August 25, 2017, 1:03pm UTC](https://discuss.elastic.co/t/drop-network-events/98032/6 "2017-08-25T13:03:37Z")

</div>

its just lo

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 22, 2017, 1:04pm UTC](https://discuss.elastic.co/t/drop-network-events/98032/7 "2017-09-22T13:04:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.