# DROP processor does not appear to work in elastic search 6.5.0 with GROK

**URL:** <https://discuss.elastic.co/t/drop-processor-does-not-appear-to-work-in-elastic-search-6-5-0-with-grok/158914>\
**Category:** Elasticsearch\
**Created:** [November 30, 2018, 2:32pm UTC](https://discuss.elastic.co/t/drop-processor-does-not-appear-to-work-in-elastic-search-6-5-0-with-grok/158914 "2018-11-30T14:32:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ajazam1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ajazam1/32/38237_2.png) [@ajazam1](https://discuss.elastic.co/u/ajazam1)\
**Post date:** [November 30, 2018, 2:32pm UTC](https://discuss.elastic.co/t/drop-processor-does-not-appear-to-work-in-elastic-search-6-5-0-with-grok/158914/1 "2018-11-30T14:32:57Z")

</div>

Hello,

I have been trying to get the DROP processor to work in our Elastic Cloud. We are running v6.5.0.

I am using the following pipeline

> ```
> PUT _ingest/pipeline/pipeline1
> {
> "description" : "logs",
> "processors" : [
> {
> 
> "set": {
> "field": "error",
> "value": ""
> },
> "grok" : {
> "field" : "message",
> "patterns" : [
> "%{GOT_ITEM_FROM:optype} %{WORD:tel}",
> "%{PROCESSED_ITEM_FROM:optype} %{WORD:tel}"
> ],
> "pattern_definitions" : {
> "GOT_ITEM_FROM" : "got item from",
> "PROCESSED_ITEM_FROM" : "processed item from"
> },
> "on_failure": [
> {
> "set" : {
> "field": "error",
> "value": "parseerror"
> }
> },
> {
> "drop" : {
> "if": "true",
> "tag": "inside drop processor"
> }
> 
> }
> ]
> }
> }
> ]
> }
> 
> ```

I am using the following to insert a document

> POST filebeat/server/?pipeline=pipeline1  
> {
> 
> ```
> "@timestamp": "2018-10-17T10:35:00.840Z",
> "host": {
> "name": "ISDN-SERVER"
> },
> "source": "C:\\Program Files (x86)\\2018_10_17.txt",
> "offset": 3172052,
> "message": "00:00:10.492(ID=0)(tid=10212)CelloProcessor_SMSProcessorQueueThread - (17) processed2 item from 1234",
> "input": {
> "type": "log"
> },
> "prospector": {
> "type": "log"
> },
> "beat": {
> "hostname": "SERVER",
> "version": "6.4.2",
> "name": "SERVER"
> }
> 
> ```
> 
> }

If I run

> GET /filebeat/\_search  
> {  
> "query": {  
> "match\_all": {}  
> }  
> }

I get

> {  
> "took" : 2,  
> "timed\_out" : false,  
> "\_shards" : {  
> "total" : 5,  
> "successful" : 5,  
> "skipped" : 0,  
> "failed" : 0  
> },  
> "hits" : {  
> "total" : 1,  
> "max\_score" : 1.0,  
> "hits" : [  
> {  
> "\_index" : "filebeat",  
> "\_type" : "server",  
> "\_id" : "k0vyZGcBpDcMS92QpBWK",  
> "\_score" : 1.0,  
> "\_source" : {  
> "offset" : 3172052,  
> "prospector" : {  
> "type" : "log"  
> },  
> "source" : """C:\Program Files (x86)\2018\_10\_17.txt""",  
> "message" : "00:00:10.492(ID=0)(tid=10212)CelloProcessor\_SMSProcessorQueueThread - (17) processed2 item from 1234",  
> "error" : "parseerror",  
> "input" : {  
> "type" : "log"  
> },  
> "@timestamp" : "2018-10-17T10:35:00.840Z",  
> "host" : {  
> "name" : "SERVER"  
> },  
> "beat" : {  
> "hostname" : "SERVER",  
> "name" : "SERVER",  
> "version" : "6.4.2"  
> }  
> }  
> }  
> ]  
> }  
> }

What I expected was for GROK to not do a pattern match and then for DROP to drop the document.

The DROP feature does work in logstash but we did not want to use logstash. It's another aws instance.

Has anybody got the DROP processor working in conjunction with GROK in Elastic Search without using logstash?

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [December 3, 2018, 10:23am UTC](https://discuss.elastic.co/t/drop-processor-does-not-appear-to-work-in-elastic-search-6-5-0-with-grok/158914/2 "2018-12-03T10:23:17Z")

</div>

This looks like a bug to me. I opened an issue and you can follow it at [https://github.com/elastic/elasticsearch/issues/36151](https://github.com/elastic/elasticsearch/issues/36151)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 31, 2018, 10:23am UTC](https://discuss.elastic.co/t/drop-processor-does-not-appear-to-work-in-elastic-search-6-5-0-with-grok/158914/3 "2018-12-31T10:23:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.