# Filter: drop\_event.when.regexp.device\_name

**URL:** <https://discuss.elastic.co/t/filter-drop-event-when-regexp-device-name/68898>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [December 13, 2016, 3:55pm UTC](https://discuss.elastic.co/t/filter-drop-event-when-regexp-device-name/68898 "2016-12-13T15:55:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![slalomnut](https://avatars.discourse-cdn.com/v4/letter/s/48db29/32.png) [@slalomnut](https://discuss.elastic.co/u/slalomnut)\
**Post date:** [December 13, 2016, 3:55pm UTC](https://discuss.elastic.co/t/filter-drop-event-when-regexp-device-name/68898/1 "2016-12-13T15:55:34Z")

</div>

I'm attempting to drop duplicates (i.e. only match /dev/mapper/xxx).

Is there a limitation to regex expression for the filter? I've tried multiple variations to drop fdqn matches in attempt to drop all nfs shares and metricbeat pukes when restarting. It sure would be nice to have a filesystem\_type attribute.

Thanks,  
Joel

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [December 13, 2016, 4:12pm UTC](https://discuss.elastic.co/t/filter-drop-event-when-regexp-device-name/68898/2 "2016-12-13T16:12:14Z")

</div>

> [@slalomnut](#):
>
> Is there a limitation to regex expression for the filter?

The regex support is based on RE2. See [Regular Expression Support | Metricbeat Reference [5.0] | Elastic](https://www.elastic.co/guide/en/beats/metricbeat/5.0/regexp-support.html)

> [@slalomnut](#):
>
> It sure would be nice to have a filesystem\_type attribute.

You can open an enhancement request for this.

---

<div class="post-metadata">

**Author:** ![slalomnut](https://avatars.discourse-cdn.com/v4/letter/s/48db29/32.png) [@slalomnut](https://discuss.elastic.co/u/slalomnut)\
**Post date:** [December 14, 2016, 12:03am UTC](https://discuss.elastic.co/t/filter-drop-event-when-regexp-device-name/68898/3 "2016-12-14T00:03:48Z")

</div>

Thanks Andrew. I found an expression that worked. However, do I understand correctly that filters is replaced by processors?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 11, 2017, 12:03am UTC](https://discuss.elastic.co/t/filter-drop-event-when-regexp-device-name/68898/4 "2017-01-11T00:03:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.