# Processor not working

**URL:** <https://discuss.elastic.co/t/processor-not-working/197955>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 3, 2019, 10:04pm UTC](https://discuss.elastic.co/t/processor-not-working/197955 "2019-09-03T22:04:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nee\_Defeng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nee_defeng/32/45771_2.png) [@Nee\_Defeng](https://discuss.elastic.co/u/Nee_Defeng)\
**Post date:** [September 3, 2019, 10:04pm UTC](https://discuss.elastic.co/t/processor-not-working/197955/1 "2019-09-03T22:04:50Z")

</div>

I am trying to use processors in filebeat, but the testing was not working as I expected.

Here is the config:

```
#=========================== Filebeat inputs =============================
processors:
- drop_event:
    when:
       contains:
         message: "xyz"

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

- type: stdin

```

And when I type 'I am not a fan of xyz' from the console, the event is not dropped, as below.

```
.......
    "version": "7.3.1",
    "type": "filebeat",
    "ephemeral_id": "b5afb0fe-7ccd-49fc-8aa9-593927a94495"
  },
  "message": "I am not a fan of xyz",
  "log": {
    "offset": 0,
    "file": {
      "path": ""
    }
  },
  "input": {
    "type": "stdin"
  },
  "ecs": {
    "version": "1.0.1"
  }
}

```

anything is wrong?

---

<div class="post-metadata">

**Author:** ![Nee\_Defeng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nee_defeng/32/45771_2.png) [@Nee\_Defeng](https://discuss.elastic.co/u/Nee_Defeng)\
**Post date:** [September 3, 2019, 10:19pm UTC](https://discuss.elastic.co/t/processor-not-working/197955/2 "2019-09-03T22:19:08Z")

</div>

it is working if I put this processor under a particular type, but not the global setting level.

However,the documentation says below, is my understanding wrong?

### Where are processors valid?[edit](https://github.com/elastic/beats/edit/7.3/libbeat/docs/processors-using.asciidoc)

Processors are valid:

\*\*\*\* At the top-level in the configuration. The processor is applied to all data collected by Filebeat.\*\*\*

- Under a specific input. The processor is applied to the data collected for that input. For example:

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 1, 2019, 10:19pm UTC](https://discuss.elastic.co/t/processor-not-working/197955/3 "2019-10-01T22:19:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.