# Filebeat 5.2 processor doesn't work

**URL:** <https://discuss.elastic.co/t/filebeat-5-2-processor-doesnt-work/151912>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 10, 2018, 6:14pm UTC](https://discuss.elastic.co/t/filebeat-5-2-processor-doesnt-work/151912 "2018-10-10T18:14:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mikhail\_mironov](https://avatars.discourse-cdn.com/v4/letter/m/e79b87/32.png) [@mikhail\_mironov](https://discuss.elastic.co/u/mikhail_mironov)\
**Post date:** [October 10, 2018, 6:14pm UTC](https://discuss.elastic.co/t/filebeat-5-2-processor-doesnt-work/151912/1 "2018-10-10T18:14:59Z")

</div>

Can you explain please, why my processor doesn't work? My config:

```
filebeat:                                                                                                                                                                                                       
  prospectors:
  - paths:
    - /var/log/samba/samba.log
    input_type: log 
    multiline.pattern: '^\['
    multiline.negate: true
    multiline.match: after
    document_type: sambalog
    close_renamed: true

  - paths:
    - /var/log/operations.log
    input_type: log 
    document_type: operationslog
    close_renamed: true
    processors:
    - drop_event:
      when:
        contains:
          message: 'MYKEYWORD'

```

Event from operations.log appears in Elasticsearch even when it contains word «MYKEYWORD». I have tried regexp processor and it doesn’t work too. Where I’ve missed? Thank you.

---

<div class="post-metadata">

**Author:** ![mikhail\_mironov](https://avatars.discourse-cdn.com/v4/letter/m/e79b87/32.png) [@mikhail\_mironov](https://discuss.elastic.co/u/mikhail_mironov)\
**Post date:** [October 11, 2018, 7:48am UTC](https://discuss.elastic.co/t/filebeat-5-2-processor-doesnt-work/151912/2 "2018-10-11T07:48:07Z")

</div>

Filebeat 5.6.12. The same issue. Config:

```
filebeat:
  prospectors:
  - paths:
    - /var/log/test.log
    input_type: log 
    document_type: testlog
    close_renamed: true
    processors:
    - drop_event:
      when:
        contains:
          message: 'MYKEYWORD'
output:
  file:
    path: "/tmp"
    filename: filebeat

```

When I do «echo MYKEYWORD \>\> /var/log/test.log» the message appears in /tmp/filebeat. What's wrong?

---

<div class="post-metadata">

**Author:** ![mikhail\_mironov](https://avatars.discourse-cdn.com/v4/letter/m/e79b87/32.png) [@mikhail\_mironov](https://discuss.elastic.co/u/mikhail_mironov)\
**Post date:** [October 11, 2018, 9:05am UTC](https://discuss.elastic.co/t/filebeat-5-2-processor-doesnt-work/151912/3 "2018-10-11T09:05:35Z")

</div>

This way works as expected:

```
filebeat:
  prospectors:
  - paths:
    - /var/log/test.log
    input_type: log 
    document_type: testlog
    close_renamed: true
    exclude_lines: ['MYKEYWORD']

output:
  file:
    path: "/tmp"
    filename: filebeat
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 8, 2018, 9:19am UTC](https://discuss.elastic.co/t/filebeat-5-2-processor-doesnt-work/151912/4 "2018-11-08T09:19:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.