Is it possible to use the elasticsearch template to create a filter template in logstash

Elastic Stack Logstash
3

OK, so found out that auditbeat is sending the entries as a json format. So I'm guessing I need to filter with something like:

filter {
  json {
    source => "message"
    if [user.name_map.auid] == "nagios" {
      drop { }
    }
  }
}

Trying to lose the ones created by nagios. Cheers