# Filebeat Processors drop\_event
**URL:** https://discuss.elastic.co/t/filebeat-processors-drop-event/257856
**Category:** Beats
**Tags:** filebeat
**Created:** [December 7, 2020, 1:21pm UTC](https://discuss.elastic.co/t/filebeat-processors-drop-event/257856 "2020-12-07T13:21:29Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@erezhazan1](https://discuss.elastic.co/u/erezhazan1)
#### Post date: [December 7, 2020, 1:21pm UTC](https://discuss.elastic.co/t/filebeat-processors-drop-event/257856/1 "2020-12-07T13:21:29Z")
Hey all!
I need your help with the following,
I'm trying to get this condition to work:
**If not** (message: '^._dstintf="aaaa"._' **OR** message: '^._dstintf="bbb"._')
**AND NOT** (message: '^._action="ccc"._' **AND** message: '^._action="dddd"._' **AND** message: '^._action="eeee"._')
For some reason, I'm having a hard time getting the right way.
I tried doing something like this:
```auto
- if:
equals:
type: "xxxxx"
then:
- drop_event:
when:
not:
or:
- regexp:
message: '^.*dstintf=\"aaaa\".*'
- regexp:
message: '^.*dstintf=\"bbbb\".*'
- and:
- regexp:
message: '^.*action=\"cccc\".*'
- regexp:
message: '^.*action=\"dddd\".*'
- regexp:
message: '^.*action=\"eeee\".*'
- regexp:
message: '^.*action=\"ffff\".*'
```
---
### Author:  [@jsoriano](https://discuss.elastic.co/u/jsoriano)
#### Post date: [December 8, 2020, 6:52pm UTC](https://discuss.elastic.co/t/filebeat-processors-drop-event/257856/2 "2020-12-08T18:52:02Z")
Hey @erezhazan1, welcome to discuss 🙂
Is this what you are trying to do?
```auto
- drop_event:
when:
and:
- not:
or:
- regexp:
message: '^.*dstintf=\"aaaa\".*'
- regexp:
message: '^.*dstintf=\"bbbb\".*'
- not:
and:
- regexp:
message: '^.*action=\"cccc\".*'
- regexp:
message: '^.*action=\"dddd\".*'
- regexp:
message: '^.*action=\"eeee\".*'
- regexp:
message: '^.*action=\"ffff\".*'
```
Take into account that "if not (A) and not (B)" needs to be implemented like this:
```auto
- drop_event:
when:
and:
- not:
(A)
- not:
(B)
```
---
### Author:  [@erezhazan1](https://discuss.elastic.co/u/erezhazan1)
#### Post date: [December 9, 2020, 12:50pm UTC](https://discuss.elastic.co/t/filebeat-processors-drop-event/257856/3 "2020-12-09T12:50:54Z")
Hey!
Thanks for your replay.
I manged to get it to work, and what I was looking for what eventually this:
```auto
then:
- drop_event:
when:
or:
- not:
or:
- regexp:
message: '^.*dstintf=\"aaaa\".*'
- regexp:
message: '^.*dstintf=\"bbbb\".*'
- regexp:
message: '^.*action=\"cccc\".*'
- regexp:
message: '^.*action=\"ddddd\".*'
- regexp:
message: '^.*action=\"eeeee\".*'
- regexp:
message: '^.*action=\"fffff\".*'
```
I probably didn't expain myself right but your config got me into the right direction.
Thanks again!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 6, 2021, 2:50pm UTC](https://discuss.elastic.co/t/filebeat-processors-drop-event/257856/4 "2021-01-06T14:50:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.