# Need help in dropping DNS event with packetbeat
**URL:** https://discuss.elastic.co/t/need-help-in-dropping-dns-event-with-packetbeat/197395
**Category:** Beats
**Tags:** packetbeat
**Created:** [August 29, 2019, 6:11pm UTC](https://discuss.elastic.co/t/need-help-in-dropping-dns-event-with-packetbeat/197395 "2019-08-29T18:11:49Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@Blason](https://discuss.elastic.co/u/Blason)
#### Post date: [August 29, 2019, 6:11pm UTC](https://discuss.elastic.co/t/need-help-in-dropping-dns-event-with-packetbeat/197395/1 "2019-08-29T18:11:49Z")
Hi team,
I am trying to drop certain events on my AD server since I have packet beat installed and listening for DNS ports.
I somehow unable to get it working, and I really appreciate if someone can help me on this?
Here is what I am trying to do.
```
- type: dns
```
# Configure the ports where to listen for DNS traffic. You can disable
# the DNS protocol by commenting out the list of ports.
ports: [53]
```
processors:
```
- drop\_event:
when:
contains:
dns.question.etld\_plus\_one: "[example.com](http://example.com)"
Plus wanted to know how do I use AND/OR with the above processor? as I also need to drop the events when contains
in-addr.arpa.
TIA
Blason R
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [August 29, 2019, 6:19pm UTC](https://discuss.elastic.co/t/need-help-in-dropping-dns-event-with-packetbeat/197395/2 "2019-08-29T18:19:46Z")
Hi @Blason
All the logic for the processors can be found [here](https://www.elastic.co/guide/en/beats/packetbeat/current/defining-processors.html#defining-processors)
Also it is difficult to read your configurations it is much better if you surround them with the code formatting button found at the top of the editor ``
And when you say it is not working additional information like, is it failing at startup? do you still see the events in the logs? etc is helpful otherwise it is very hard to know what is not working.
---
### Author:  [@Blason](https://discuss.elastic.co/u/Blason)
#### Post date: [August 30, 2019, 2:06am UTC](https://discuss.elastic.co/t/need-help-in-dropping-dns-event-with-packetbeat/197395/3 "2019-08-30T02:06:43Z")
My bad working as in - as soon as the modified yml file is loaded service refused to start and its pretty sure due to misconfiguration.
And here are the codes in pr`Preformatted text`operly formatted manner -
`- type: dns`
`ports: [53]`
And here are my processessors
```
`processors:
- drop_event:
when:
contains:
dns.question.etld_plus_one: "example.com"`
```
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [August 30, 2019, 2:32am UTC](https://discuss.elastic.co/t/need-help-in-dropping-dns-event-with-packetbeat/197395/4 "2019-08-30T02:32:27Z")
If you look at the error messages it should point you to the lines, yml files are hard to debug, if you use an editor that does yml checking or an online yml checker like [here](https://codebeautify.org/yaml-validator) that should help. In general the `when` and `contains` above looks ok to me but you may have bad yml / indentation there or elsewhere.
You can also post a few lines of the error and perhaps someone can help...
---
### Author:  [@Blason](https://discuss.elastic.co/u/Blason)
#### Post date: [August 30, 2019, 2:49am UTC](https://discuss.elastic.co/t/need-help-in-dropping-dns-event-with-packetbeat/197395/5 "2019-08-30T02:49:11Z")
Nope I got it working thanks for the help; just keen to know on AND/OR opertors with processors. Can you help me with Syntax pls?
```
`processors:
- drop_event:
when:
contains:
dns.question.etld_plus_one: "example.com"`
```
OR
`contains: dns.question.etld_plus_one: "in-addr.arpa"`
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [August 30, 2019, 3:36am UTC](https://discuss.elastic.co/t/need-help-in-dropping-dns-event-with-packetbeat/197395/6 "2019-08-30T03:36:14Z")
Syntax is right [here](https://www.elastic.co/guide/en/beats/packetbeat/current/defining-processors.html#condition-or)
```
or:
-
-
-
...
```
---
### Author:  [@Blason](https://discuss.elastic.co/u/Blason)
#### Post date: [August 31, 2019, 4:30am UTC](https://discuss.elastic.co/t/need-help-in-dropping-dns-event-with-packetbeat/197395/7 "2019-08-31T04:30:08Z")
Hi there,
There is something wrong at YAML spacing hence I am not understanding the correct spaces to be used with OR or AND operators
e.g.
```auto
- drop_event:
when:
contains:
dns.question.etld_plus_one: "example.com"
- drop_event:
when:
contains:
dns.question.etld_plus_one: "in-addr.arpa
```
However I wanted to configure like this
```auto
- drop_event:
when:
contains:
dns.question.etld_plus_one: "example.com"
or:
contains:
dns.question.etld_plus_one: "in-addr.arpa
```
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [September 1, 2019, 8:55pm UTC](https://discuss.elastic.co/t/need-help-in-dropping-dns-event-with-packetbeat/197395/8 "2019-09-01T20:55:10Z")
Yes `yml` is very specific. I use 2 spaces (don't mix in tabs) , the `-` which are items in a list take 2 spaces + 2 spaces for the sub items so it should look like this. I just made this work so it should work specifically how I have it laid out.
```
- type: dns
# Configure the ports where to listen for DNS traffic. You can disable
# the DNS protocol by commenting out the list of ports.
ports: [53]
processors:
- drop_event:
when:
or:
- contains:
dns.question.etld_plus_one: "yahoo.com"
- contains:
dns.question.etld_plus_one: "google.com"
```
EDIT : Removed 2nd example as the syntax was not correct, my error.
---
### Author:  [@Blason](https://discuss.elastic.co/u/Blason)
#### Post date: [September 2, 2019, 4:09am UTC](https://discuss.elastic.co/t/need-help-in-dropping-dns-event-with-packetbeat/197395/9 "2019-09-02T04:09:41Z")
Awesome!! Thanks man.
Really appreciate your quick response.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 30, 2019, 4:09am UTC](https://discuss.elastic.co/t/need-help-in-dropping-dns-event-with-packetbeat/197395/10 "2019-09-30T04:09:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.