Hello, I want to drop all events that filebeat was unable to parse. I tried a few things my last attempt looks like this. processors: - drop_event: when: and: - equals.event.module: cisco - equals.message: "failed to find message" But I can still see the e…

[image] Adriann: "failed to find message" One last thing because after looking at this again, there's something I don't understand: Where do you get that message? Your Cisco message is, for example, Teardown TCP connection 23913857 for name-1:ip-2/49903 to name-2:ip-3/23 duration 25:54:08 b…

Discuss the Elastic Stack

How to drop events only from specific module

Elastic Stack Beats

Adriann (Adrian) November 4, 2020, 4:04pm 9

It's working the last document with this field I got from

"@timestamp" : "2020-11-04T16:52:58.000+01:00",

Topic		Replies	Views
Filebeat drop_event Beats filebeat	2	4013	July 5, 2017
Filebeat.yml drop event not working Beats filebeat	3	847	October 15, 2020
Exclude messages with Strings Beats filebeat	3	913	January 11, 2018
Cannot drop_event by system.syslog.program field Beats filebeat	2	1014	April 12, 2019
Filebeat drop_event module input Beats filebeat	4	927	November 25, 2020

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

How to drop events only from specific module

Related topics