How to drop delayed events beyond a certain threshold?


I need correct syntax for below pseudo code

filter {
if [timestamp] < now - 120 {
drop {}

i want to drop messages delayed for more than 120secs in certain usage.
I did search for 2 hrs before posting this message.
What docs should i have seen to avoid this post ?

Thnaks & Regards for this wonderful software.

Rajesh Mallah.

You could for example use a ruby filter. Its documentation contains an example that's fairly close to what you want to do.