Filebeat processors not dropping events

Hi Team,

I am using filebeat 7.9.3 to ship events.
I do want to drop events that contains any of the below key-value pairs. I am using processors to do the same, but somehow it is not working for me.

      - drop_event:
              - equals:
                  source.ip: ""
              - contains:
              - contains:
              - contains:
              - contains:
              - contains:

Also, Which option is better to use Processors or Exclude?

Hi @Rahul_Dankhara,

Where are you placing these processors in your config?

Could you share an example document that is not being dropped with these conditions?