Can you explain please, why my processor doesn't work? My config:
filebeat: prospectors: - paths: - /var/log/samba/samba.log input_type: log multiline.pattern: '^\[' multiline.negate: true multiline.match: after document_type: sambalog close_renamed: true - paths: - /var/log/operations.log input_type: log document_type: operationslog close_renamed: true processors: - drop_event: when: contains: message: 'MYKEYWORD'
Event from operations.log appears in Elasticsearch even when it contains word «MYKEYWORD». I have tried regexp processor and it doesn’t work too. Where I’ve missed? Thank you.