Hello team, Im new on filebeat and i want to ask about processor script on filebeat. I have a log file that contains some event.code. i want to exclude 3 event code based on this condition below from my log event.code : (1234 or 4567 or 7890 AND (event.duration < 3600000000000 OR event.bytes < 10…

Filebeat filtering, drop event processor script

can.ozdemir (Can Ozdemir) February 2, 2022, 10:53am 11

Whats the mapping on event.code, are you sure its indexed as text maybe you are trying to do an equation using a string and a number.

Topic		Replies	Views
Filebeat drop_event Beats filebeat	2	4004	July 5, 2017
Filebeat processors not dropping events Beats filebeat	3	340	March 19, 2021
Drop_event proccessor Beats filebeat	2	405	March 8, 2018
Filebeat Filtering - Drop Event when NOT contain field that equals a value Beats docker , filebeat	9	8443	July 3, 2021
Drop event processor not working on Filebeat Beats filebeat	5	565	August 30, 2023

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Filebeat filtering, drop event processor script

Related topics