# Is it possible to have Auditbeat filter before sending the results
**URL:** https://discuss.elastic.co/t/is-it-possible-to-have-auditbeat-filter-before-sending-the-results/158210
**Category:** Beats
**Tags:** auditbeat
**Created:** [November 26, 2018, 3:28pm UTC](https://discuss.elastic.co/t/is-it-possible-to-have-auditbeat-filter-before-sending-the-results/158210 "2018-11-26T15:28:54Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@nlh](https://discuss.elastic.co/u/nlh)
#### Post date: [November 26, 2018, 3:28pm UTC](https://discuss.elastic.co/t/is-it-possible-to-have-auditbeat-filter-before-sending-the-results/158210/1 "2018-11-26T15:28:54Z")
I'd like to filter out a number of processes, before Auditbeat sends to Logstash. Sure the filter works on Logstash, but it is causing lots of reporting and network traffic that could be avoided.
So Auditbeat is on one system Logstash on another.
Yes I guess I could put Logstash on the Auditbeat system, but this is a heavily loaded system and we'd rather try to avoid it. What would be good is to have some of the Logstash filtering in the Auditbeat itself and perhaps remove the need for Logstash all together if it is only used for filtering before getting to Elasticsearch.
Just a thought.
---
### Author:  [@webmat](https://discuss.elastic.co/u/webmat)
#### Post date: [November 26, 2018, 4:02pm UTC](https://discuss.elastic.co/t/is-it-possible-to-have-auditbeat-filter-before-sending-the-results/158210/2 "2018-11-26T16:02:01Z")
Hi!
You can already do this with the `drop` processor. You drop only when a certain condition matches. Here are two links to get you started:
- [drop processor](https://www.elastic.co/guide/en/beats/filebeat/current/drop-event.html)
- [defining processors](https://www.elastic.co/guide/en/beats/filebeat/current/defining-processors.html) (look at the "Conditions" section, in particular)
---
### Author:  [@nlh](https://discuss.elastic.co/u/nlh)
#### Post date: [November 26, 2018, 4:35pm UTC](https://discuss.elastic.co/t/is-it-possible-to-have-auditbeat-filter-before-sending-the-results/158210/3 "2018-11-26T16:35:20Z")
Hi Matthieu, Just to confirm that this is in the auditbeat.yml file? Before it even gets to Logstash? You might have just made my day. Thanks, N
---
### Author:  [@nlh](https://discuss.elastic.co/u/nlh)
#### Post date: [November 28, 2018, 2:36pm UTC](https://discuss.elastic.co/t/is-it-possible-to-have-auditbeat-filter-before-sending-the-results/158210/4 "2018-11-28T14:36:32Z")
Hi, so I have in logstash a filter of
```
if [process][exe] == "/opt/tivoli/tsm/client/ba/bin/dsmc" {
drop { }
}
```
is the equivalent in Auditbeat
```
#================================ Processors =====================================
# Configure processors to enhance or manipulate events generated by the beat.
processors:
- drop_event:
equals:
process.exe: /opt/tivoli/tsm/client/ba/bin/dsmc
```
And if I want to add further ones like this something like
```
processors:
- drop_event:
equals:
process.exe: /opt/tivoli/tsm/client/ba/bin/dsmc
equals:
process.exe: /usr/bin/rsync
```
Or would it be more efficient to use an or: in here.
---
### Author:  [@adrisr](https://discuss.elastic.co/u/adrisr)
#### Post date: [December 10, 2018, 3:29pm UTC](https://discuss.elastic.co/t/is-it-possible-to-have-auditbeat-filter-before-sending-the-results/158210/5 "2018-12-10T15:29:41Z")
That's probably not going to work as expected. It's easier with two processors:
```auto
processors:
- drop_event:
equals:
process.exe: /opt/tivoli/tsm/client/ba/bin/dsmc
- drop_event:
equals:
process.exe: /usr/bin/rsync
```
---
### Author:  [@nlh](https://discuss.elastic.co/u/nlh)
#### Post date: [December 10, 2018, 3:58pm UTC](https://discuss.elastic.co/t/is-it-possible-to-have-auditbeat-filter-before-sending-the-results/158210/6 "2018-12-10T15:58:41Z")
Thanks Adrian, will give it a go.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 31, 2018, 4:07pm UTC](https://discuss.elastic.co/t/is-it-possible-to-have-auditbeat-filter-before-sending-the-results/158210/7 "2018-12-31T16:07:54Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.