# Filebeat. How drop events with IIS module?

**URL:** <https://discuss.elastic.co/t/filebeat-how-drop-events-with-iis-module/286637>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 13, 2021, 2:41pm UTC](https://discuss.elastic.co/t/filebeat-how-drop-events-with-iis-module/286637 "2021-10-13T14:41:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![psyapathy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/psyapathy/32/50265_2.png) [@psyapathy](https://discuss.elastic.co/u/psyapathy)\
**Post date:** [October 13, 2021, 2:41pm UTC](https://discuss.elastic.co/t/filebeat-how-drop-events-with-iis-module/286637/1 "2021-10-13T14:41:22Z")

</div>

Hi!

I use IIS module for collect IIS logs.  
I want drop events if field url.path contains "layouts".  
Where in the config should I use the processors block with drop\_events? In filebeat.yml or iis.yml?

Can you show me example? Thank you advance

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [October 19, 2021, 1:37am UTC](https://discuss.elastic.co/t/filebeat-how-drop-events-with-iis-module/286637/2 "2021-10-19T01:37:12Z")

</div>

So u could do this on the filebeat side in the `iis.yml` but since the log message isn't parsed until it gets to Elasticsearch you'll have to do regex match on the entire message. The other option is to modify the existing Elasticsearch ingest pipeline to drop the event once the `url.path` field is populated and can do a simpler match.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [October 19, 2021, 1:43am UTC](https://discuss.elastic.co/t/filebeat-how-drop-events-with-iis-module/286637/3 "2021-10-19T01:43:12Z")

</div>

Another approach is, you can add a `index.final_pipeline` to the [index settings](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-modules.html) / template that way you don't have to modify the existing pipeline and then that'll get run at the end.

That pipeline can drop the events you want.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 16, 2021, 3:43am UTC](https://discuss.elastic.co/t/filebeat-how-drop-events-with-iis-module/286637/4 "2021-11-16T03:43:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.