# Drop Processors on .yml file **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [July 7, 2022, 12:08pm UTC](https://discuss.elastic.co/t/drop-processors-on-yml-file/309109 "2022-07-07T12:08:53Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![maviles](https://avatars.discourse-cdn.com/v4/letter/m/ccd318/32.png) [@maviles](https://discuss.elastic.co/u/maviles)\ **Post date:** [July 7, 2022, 12:08pm UTC](https://discuss.elastic.co/t/drop-processors-on-yml-file/309109/1 "2022-07-07T12:08:53Z")
Hi, I am unable to use the following drop processors on yml processors: - drop\_event.when: network: destination.ip: ['8.8.8.8/32', '8.8.4.4/32', '10.10.10.10/32'] ---
**Author:** ![hansc](https://avatars.discourse-cdn.com/v4/letter/h/a8b319/32.png) [@hansc](https://discuss.elastic.co/u/hansc)\ **Post date:** [July 7, 2022, 12:24pm UTC](https://discuss.elastic.co/t/drop-processors-on-yml-file/309109/2 "2022-07-07T12:24:32Z")
Try this? ```auto - drop_event.when.network.destination.ip: ['8.8.8.8/32', '8.8.4.4/32', '10.10.10.10/32'] ``` If not working, please post logs and configuration as preformatted to keep their indents. ---
**Author:** ![maviles](https://avatars.discourse-cdn.com/v4/letter/m/ccd318/32.png) [@maviles](https://discuss.elastic.co/u/maviles)\ **Post date:** [July 7, 2022, 12:43pm UTC](https://discuss.elastic.co/t/drop-processors-on-yml-file/309109/3 "2022-07-07T12:43:53Z")
Hello, I tried, the filebeat is running but the processor is not dropping the events. I also followed the elastic guide for processor configurations. ![Processor filebeat forum](https://us1.discourse-cdn.com/elastic/original/3X/b/3/b30af359d767e80a2efdec1fcd6e5db60e88a44c.jpeg) ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/8/68cc0136fb6c09ac9304d898cc24bd3fa80e63ed.png) ---
**Author:** ![hansc](https://avatars.discourse-cdn.com/v4/letter/h/a8b319/32.png) [@hansc](https://discuss.elastic.co/u/hansc)\ **Post date:** [July 7, 2022, 1:00pm UTC](https://discuss.elastic.co/t/drop-processors-on-yml-file/309109/4 "2022-07-07T13:00:11Z")
There must be indents ```auto processors: - drop_event.when.network.destination.ip: ['8.8.8.8/32', '8.8.4.4/32', '10.10.10.10/32'] ``` If it is not working, the log of your beat (I guess packetbeat?) might have helpful information. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [July 7, 2022, 5:47pm UTC](https://discuss.elastic.co/t/drop-processors-on-yml-file/309109/5 "2022-07-07T17:47:28Z")
What module are you using? There is often confusion when using processors in filebeat / beats In short the fields need to exist on the filebeat side / context ... but often the fields are only created / parsed / available AFTER they have been transmitted and processed on the elasticsearch ingest pipeline side... That is where the parsing is... So in short you may be trying to drop in filebeat based on a field that does not exist yet in the filebeat context... because it has not been parsed out yet. An easy what to check what fields are available is to set the filebeat output to console and see what the data looks like... you will only be able to operate on the fields available. Hope this makes sense That is not to say you can not possibly do it by using `contains` condition ... or another way... ---
**Author:** ![hansc](https://avatars.discourse-cdn.com/v4/letter/h/a8b319/32.png) [@hansc](https://discuss.elastic.co/u/hansc)\ **Post date:** [July 7, 2022, 6:13pm UTC](https://discuss.elastic.co/t/drop-processors-on-yml-file/309109/6 "2022-07-07T18:13:03Z")
Looks like packetbeat since he is using destination.ip. That field should be not a problem. I guess the problem was coming from tab indentation. I am not sure without seeing the log, that is why I suggest put all setting in one line to make sure. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [July 7, 2022, 6:17pm UTC](https://discuss.elastic.co/t/drop-processors-on-yml-file/309109/7 "2022-07-07T18:17:07Z")
Yep, I like the one line method too. But I'm not assuming packbeat until I see it, @maviles Are you using packetbeat or filebeat? And yes @maviles Please include your full .yml and logs if you can ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 4, 2022, 8:17pm UTC](https://discuss.elastic.co/t/drop-processors-on-yml-file/309109/8 "2022-08-04T20:17:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.