# Event Filter endpoint agent via Kibana (Fleet) with wildcards **URL:** \ **Category:** Beats\ **Tags:** docker, elastic-agent\ **Created:** [November 8, 2021, 8:40pm UTC](https://discuss.elastic.co/t/event-filter-endpoint-agent-via-kibana-fleet-with-wildcards/288680 "2021-11-08T20:40:30Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![tfriesen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tfriesen/32/96772_2.png) [@tfriesen](https://discuss.elastic.co/u/tfriesen)\ **Post date:** [November 8, 2021, 8:40pm UTC](https://discuss.elastic.co/t/event-filter-endpoint-agent-via-kibana-fleet-with-wildcards/288680/1 "2021-11-08T20:40:31Z")
Situation: I'm deploying endpoint security via Fleet and Elastic agent. Many of the default settings cause the agents to be extremely chatty, shipping many uninteresting, chatty logs. I want to filter out some of these events, and it seems that the Official Method is to use Security\>Endpoints\>Event filters. The problem is that one of the types of superfluous logs are, eg, being generated are file operations done by docker, which are a LOT; however, they're easy to identify as they all happen in /var/lib/docker/. Other sources of chatty logs have similar situations. Unfortunately, it seems like I'm not able to use a wildcard like 'file.path' is '/var/lib/docker/\*'. The Event filter takes it, but.... doesn't work. I've tried various combinations of file.path, file.path.text, escape and wildcard characters, but I can't seem to filter out anything using Event filters unless it's an exact match to the field I'm using. Prior to Elastic Agent, I would just pop a 'drop' processor into the filebeat.yml, or whatever, to filter out these logs, but there doesn't seem to be a way to add custom processors to most Elastic Agent integrations, including Endpoint security. I guess I could try modifying the ingest pipeline, but I'd rather use the Official Method, for scalability and maintainability reasons. TL;DR Wildcards don't seem to work with Event Filters; can this be fixed/am I doing it wrong/how do I add processors to Endpoint security? ---
**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\ **Post date:** [November 9, 2021, 9:44am UTC](https://discuss.elastic.co/t/event-filter-endpoint-agent-via-kibana-fleet-with-wildcards/288680/2 "2021-11-09T09:44:43Z")
That's odd. I think they should be supported. See: [Kibana queries and filters | Packetbeat Reference [7.15] | Elastic](https://www.elastic.co/guide/en/beats/packetbeat/current/kibana-queries-filters.html#_regexp_queries) Would you mind posting a screenshot here? ---
**Author:** ![tfriesen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tfriesen/32/96772_2.png) [@tfriesen](https://discuss.elastic.co/u/tfriesen)\ **Post date:** [November 9, 2021, 5:08pm UTC](https://discuss.elastic.co/t/event-filter-endpoint-agent-via-kibana-fleet-with-wildcards/288680/3 "2021-11-09T17:08:19Z")
Not at all. ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/9/791f9b4090289c7b327405be7282364f61d7b261.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/9/f91c467aa27d2fad2d386ec21cdab8d28552c36d.png) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 7, 2021, 7:09pm UTC](https://discuss.elastic.co/t/event-filter-endpoint-agent-via-kibana-fleet-with-wildcards/288680/4 "2021-12-07T19:09:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.