# Logstash filter doesn't appear to be functioning
**URL:** https://discuss.elastic.co/t/logstash-filter-doesnt-appear-to-be-functioning/380108
**Category:** Logstash
**Created:** [July 14, 2025, 2:13pm UTC](https://discuss.elastic.co/t/logstash-filter-doesnt-appear-to-be-functioning/380108 "2025-07-14T14:13:56Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@bmf614zzz](https://discuss.elastic.co/u/bmf614zzz)
#### Post date: [July 14, 2025, 2:13pm UTC](https://discuss.elastic.co/t/logstash-filter-doesnt-appear-to-be-functioning/380108/1 "2025-07-14T14:13:56Z")
Hello,
Logstash version: 6.8.23
data
message: cmd\_logger\_api.c(260) 10987641 %% INFO [CLI:backupguy:10.0.1.254] User has logged out
type: rsyslog
Logstash filter:
filter {
if "backupguy" in [message] { drop {} }
}
Problem:
I still seem to be getting the string backupguy in the message field created in Elasticsearch anyone have any ideas why?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 14, 2025, 4:33pm UTC](https://discuss.elastic.co/t/logstash-filter-doesnt-appear-to-be-functioning/380108/2 "2025-07-14T16:33:04Z")
Please show us exactly what the [message] field looks like in either rubydebug or JSON markup. That conditional would fail if [message] is an array (or even a hash), there may be other reasons too.
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [July 14, 2025, 4:59pm UTC](https://discuss.elastic.co/t/logstash-filter-doesnt-appear-to-be-functioning/380108/3 "2025-07-14T16:59:54Z")
Have you restarted LS after added drop?
Also you can use regex
`if [message] =~ /backupguy/ { `