# Filter values in Metricbeat 8.7.0

**URL:** <https://discuss.elastic.co/t/filter-values-in-metricbeat-8-7-0/372583>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [December 29, 2024, 8:21am UTC](https://discuss.elastic.co/t/filter-values-in-metricbeat-8-7-0/372583 "2024-12-29T08:21:03Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Viktor\_Movita](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/viktor_movita/32/135707_2.png) [@Viktor\_Movita](https://discuss.elastic.co/u/Viktor_Movita)\
**Post date:** [December 29, 2024, 8:21am UTC](https://discuss.elastic.co/t/filter-values-in-metricbeat-8-7-0/372583/1 "2024-12-29T08:21:03Z")

</div>

Hello,  
I am using Metricbeat version 8.7.0 and trying to filter values in the `system.process.cmdline` field.  
I added the following section to the `system.yml` file:

```auto
- module: system
  period: 1m
  metricsets:
    - process
  processors:
    - drop_event.when.not.regexp:
        system.process.cmdline: "C:.*"

```

(I am looking for processes whose cmdline contains the drive C:)  
On the surface, it runs (no errors), and it looks correct according to the documentation, but in practice, it does not perform the filtering.  
Has anyone encountered this issue?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 29, 2024, 5:47pm UTC](https://discuss.elastic.co/t/filter-values-in-metricbeat-8-7-0/372583/2 "2024-12-29T17:47:27Z")

</div>

Hi @Viktor_Movita

> [@Viktor\_Movita](#):
>
> ```auto
> processors:
> - drop_event.when.not.regexp:
> system.process.cmdline: "C:.*"
> 
> ```

Hmmm

I just tried this on my mac and this works fine... (I did test a later version but this functionality has been there for a long time)

```auto
  processors:
  - drop_event.when.not.regexp:
      system.process.cmdline: "^/System/Library/.*"

```

Can you show a sample of the `system.process.cmdline` from a document that is not filtered that should be... show that JSON that is capture in Elastic from disover

BTW you should anchor the regex with a `^` for starts with... faster / more efficient. ` "^C:.*"`