# Metricbeat service terminates when \`or\` condition in \`drop\_event\`

**URL:** <https://discuss.elastic.co/t/metricbeat-service-terminates-when-or-condition-in-drop-event/114365>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [January 6, 2018, 10:45am UTC](https://discuss.elastic.co/t/metricbeat-service-terminates-when-or-condition-in-drop-event/114365 "2018-01-06T10:45:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![amjadcas](https://avatars.discourse-cdn.com/v4/letter/a/e47c2d/32.png) [@amjadcas](https://discuss.elastic.co/u/amjadcas)\
**Post date:** [January 6, 2018, 10:45am UTC](https://discuss.elastic.co/t/metricbeat-service-terminates-when-or-condition-in-drop-event/114365/1 "2018-01-06T10:45:28Z")

</div>

I'm using Metricbeat 6.1.1 on a Windows Server 2012.

My goal is to monitor services, but not all.

I'm using the `drop_event` processor to exclude events and the `or` condition to specify the services to exclude.

```auto
- module: windows
  metricsets: ["service"]
  period: 30s
  processors:
  - drop_event:
    when:
      or:
        - equals:
          windows.service.display_name: Service Display Name 1
        - equals:
          windows.service.display_name: Service Display Name 2
        - equals:
          ...
        - equals:
          windows.service.display_name: Service Display Name N

```

Less than 30s after starting the service, it silently terminates...

I ran `metricbeat test modules windows service` and `metricbeat test config` and both are okay. The former takes a bit of time to return something though.

However, I'm able to exclude one service but the configuration doesn't include the `or` condition.

```auto
- module: windows
  metricsets: ["service"]
  period: 60s
  processors:
  - drop_event:
    when:
      equals:
        windows.service.display_name: Service Display Name 1

```

I know that the Windows Service metricset is in beta. I just wanted to make sure that I was not doing anything wrong since I haven't seen discussions on this.

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [January 8, 2018, 8:04am UTC](https://discuss.elastic.co/t/metricbeat-service-terminates-when-or-condition-in-drop-event/114365/2 "2018-01-08T08:04:40Z")

</div>

> [@amjadcas](#):
>
> - drop\_event:  
> when:  
> or:  
> - equals:  
> windows.service.display\_name: Service Display Name 1

It looks like an indentation issue, try:

```auto
  - drop_event:
    when:
      or:
        - equals:
            windows.service.display_name: Service Display Name 1
        ...

```

Best regards

---

<div class="post-metadata">

**Author:** ![amjadcas](https://avatars.discourse-cdn.com/v4/letter/a/e47c2d/32.png) [@amjadcas](https://discuss.elastic.co/u/amjadcas)\
**Post date:** [January 8, 2018, 10:45pm UTC](https://discuss.elastic.co/t/metricbeat-service-terminates-when-or-condition-in-drop-event/114365/3 "2018-01-08T22:45:13Z")

</div>

You're right, it's an indentation issue.

What you gave me didn't solve it though. Here is what solved it:

```auto
processors:
- drop_event.when:
    or: #Extra indentation on this line
      - equals:
          windows.service.display_name: Name1 #Extra indentation on this line
      - equals:
          windows.service.display_name: Name2 #Extra indentation on this line

```

Thanks 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 5, 2018, 10:45pm UTC](https://discuss.elastic.co/t/metricbeat-service-terminates-when-or-condition-in-drop-event/114365/4 "2018-02-05T22:45:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.