Filter values in Metricbeat 8.7.0

[Viktor_Movita]

Hello,
I am using Metricbeat version 8.7.0 and trying to filter values in the system.process.cmdline field.
I added the following section to the system.yml file:

- module: system
  period: 1m
  metricsets:
    - process
  processors:
    - drop_event.when.not.regexp:
        system.process.cmdline: "C:.*"

(I am looking for processes whose cmdline contains the drive C:)
On the surface, it runs (no errors), and it looks correct according to the documentation, but in practice, it does not perform the filtering.
Has anyone encountered this issue?

[stephenb (Stephen Brown)]

Hi @Viktor_Movita

@Viktor_Movita

  processors:
    - drop_event.when.not.regexp:
        system.process.cmdline: "C:.*"

Hmmm

I just tried this on my mac and this works fine... (I did test a later version but this functionality has been there for a long time)

  processors:
  - drop_event.when.not.regexp:
      system.process.cmdline: "^/System/Library/.*"

Can you show a sample of the system.process.cmdline from a document that is not filtered that should be... show that JSON that is capture in Elastic from disover

BTW you should anchor the regex with a ^ for starts with... faster / more efficient. "^C:.*"