Filebeat processors not dropping events

Elastic Stack Beats
1

Hi Team,

I am using filebeat 7.9.3 to ship events.
I do want to drop events that contains any of the below key-value pairs. I am using processors to do the same, but somehow it is not working for me.

      processors:
      - drop_event:
          when:
            or:
              - equals:
                  source.ip: "10.0.0.8"
              - contains:
                  data.win.eventdata.parentImage: "LogMeIn.exe"
              - contains:
                  data.win.eventdata.commandLine: "Teams.exe"
              - contains:
                  data.win.eventdata.commandLine: "OneDrive"
              - contains:
                  data.win.eventdata.commandLine: "GoToMeeting"
              - contains:
                  data.win.eventdata.image: "chrome.exe"
2

Also, Which option is better to use Processors or Exclude?

3

Hi @Rahul_Dankhara,

Where are you placing these processors in your config?

Could you share an example document that is not being dropped with these conditions?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.