# Filebeat drop\_event

**URL:** <https://discuss.elastic.co/t/filebeat-drop-event/88559>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 7, 2017, 11:01am UTC](https://discuss.elastic.co/t/filebeat-drop-event/88559 "2017-06-07T11:01:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![shaktigupta200](https://avatars.discourse-cdn.com/v4/letter/s/b4bc9f/32.png) [@shaktigupta200](https://discuss.elastic.co/u/shaktigupta200)\
**Post date:** [June 7, 2017, 11:01am UTC](https://discuss.elastic.co/t/filebeat-drop-event/88559/1 "2017-06-07T11:01:36Z")

</div>

Hi Folks,

I have an issue when using processors in filebeat for dropping event when certain condition matches.  
I am trying to drop event from log which contains "log\_time" in message field. But the drop filter is not working and all file started processing without dropping.

Below is my filebeat.yml configuration file-\>

> ############################# Filebeat ######################################  
> filebeat:  
> prospectors:  
> -  
> paths:  
> - /opt/logs/app\_logs.txt  
> input\_type: log  
> fields\_under\_root: true  
> fields:  
> type: app\_log  
> server\_group: localhost  
> processors:  
> - drop\_event:  
> when:  
> regexp:  
> message: "(._|-)log\_host(._|-)"
> 
> registry\_file: /etc/filebeat/.filebeat  
> ############################# Output ##########################################

> output:  
> logstash:  
> hosts: ["127.0.0.1:5044"]  
> loadbalance: true

> ############################# Logging #########################################

> logging:  
> to\_syslog: false  
> to\_files: true  
> files:  
> path: /opt/logs/filebeat  
> name: filebeat.log  
> rotateeverybytes: 10485760 # = 10MB  
> keepfiles: 7  
> selectors: ["\*"]  
> level: error

Filebeat Published log-\>

> 2017-06-07T16:21:31+05:30 DBG Publish: {  
> "@timestamp": "2017-06-07T10:51:31.750Z",  
> "beat": {  
> "hostname": "shakti",  
> "name": "shakti",  
> "version": "5.4.1"  
> },  
> "input\_type": "log",  
> "message": "{"log\_time":"9\/Jan\/2017:14:10:21 +05:30","level":"ERROR","log\_message":"something","description":"{\"field1\":\"Exception Code\",\"field2\":000,\"field3\":\"Exception Message\",\"field4\":\"10.12.12.33: E11000 $_id_ dup key: { : ObjectId('asdsadsad111') }\",\"error\_name\":\"mongo\_log\_error\",\"data\":{\"order\_id\":\"102000176\",\"order\_info\":null,\"momoe\_order\_id\":\"292\",\"ref\_id\":\"147738220035719142144\",\"order\_tag\_momoe\_response\":null,\"\_id\":{\"$id\":\"58734c728eeb965e5f4ebf8e\"}},\"additional\_data\":{\"file\":\"\\\/home\\\/ssss\\\/vendor\\\/fusion\\\/model\\\/aaa\\\/asas.php\",\"line\":901,\"method\":\"clues\\\\model\\\\pgw\\\\Momoe::logInMongo\"},\"uUid\":\"1483951218\_3Y8dDBytHiqIw2v\"}","url":"\/tools\/momoe\_order\_updates.php?batch\_size=2\u0026batch\_limit=1--time\_before\_current%201800%20--time\_range%203600","module":"pgw","session":""," **log\_host**":"acd111"}",  
> "offset": 1487718,  
> "server\_group": "localhost",  
> "source": "/opt/logs/app\_logs.txt",  
> "type": "app\_log"  
> }

Pls suggest where I am going wrong.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [June 7, 2017, 12:55pm UTC](https://discuss.elastic.co/t/filebeat-drop-event/88559/2 "2017-06-07T12:55:48Z")

</div>

With the config being quoted I cannot tell if the indentation is correct. It should look like this:

```auto
processors:
- drop_event:
    when:
      regexp:
        message: 'log_host'

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 12:56pm UTC](https://discuss.elastic.co/t/filebeat-drop-event/88559/3 "2017-07-05T12:56:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.