# Processors drop\_event - no worky

**URL:** <https://discuss.elastic.co/t/processors-drop-event-no-worky/70970>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [January 9, 2017, 4:37pm UTC](https://discuss.elastic.co/t/processors-drop-event-no-worky/70970 "2017-01-09T16:37:17Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![panaman](https://avatars.discourse-cdn.com/v4/letter/p/3da27b/32.png) [@panaman](https://discuss.elastic.co/u/panaman)\
**Post date:** [January 9, 2017, 4:37pm UTC](https://discuss.elastic.co/t/processors-drop-event-no-worky/70970/1 "2017-01-09T16:37:17Z")

</div>

running metricbeat on centos7  
package name = metricbeat-5.1.1-1.x86\_64

The documentation says to use processors:  
[https://www.elastic.co/guide/en/beats/metricbeat/current/configuration-processors.html#conditions](https://www.elastic.co/guide/en/beats/metricbeat/current/configuration-processors.html#conditions)

If I use processors in my metricbeat.yml the drop event does not work, it just ignores it and I get no error or anything in debug mode, but if I use filters instead of processors it works.

**_THIS DOES NOT WORK_**

```auto
      processors:
        - drop_event:
            when:
             regexp:
               mount_point: '^/(run|sys|proc|dev)'
```

**_THIS DOES WORK_**

```auto
      filters:
        - drop_event:
            when:
             regexp:
               mount_point: '^/(run|sys|proc|dev)'
```

and in my /var/log/metricbeat file i see this when using filters: instead of processors:

```auto
2017-01-09T16:34:44Z DBG Processors: drop_event, condition=regexp: map[mount_point:^/(run|sys|proc|dev)]
```

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [January 10, 2017, 9:38am UTC](https://discuss.elastic.co/t/processors-drop-event-no-worky/70970/2 "2017-01-10T09:38:07Z")

</div>

Can you share your full config file?

---

<div class="post-metadata">

**Author:** ![panaman](https://avatars.discourse-cdn.com/v4/letter/p/3da27b/32.png) [@panaman](https://discuss.elastic.co/u/panaman)\
**Post date:** [January 10, 2017, 1:23pm UTC](https://discuss.elastic.co/t/processors-drop-event-no-worky/70970/3 "2017-01-10T13:23:15Z")

</div>

**THIS WORKS**

```auto
#========================== Modules configuration ============================
metricbeat.modules:
#------------------------------- System Module -------------------------------
- module: system
  metricsets:
    # CPU stats
    - cpu
    # System Load stats
    - load
    # Per filesystem stats
    - filesystem
    # Per process stats
    - process
  enabled: true
  period: 30s
  processes: ['.*']
  filters:
    - drop_event:
        when:
          or:
            - regexp:
                mount_point: '^/(run|sys|proc|dev)'
            - regexp:
                device_name: '^10.69.69'
            - equals:
                device_name: sunrpc
#================================ General =====================================
name: metricbeat
#================================ Outputs =====================================
#-------------------------- logstash output ------------------------------
output.logstash:
  hosts: ["logstash:5045"]
  ssl.certificate_authorities: ["/etc/ssl/ca-chain.crt"]
  ssl.certificate: "/etc/ssl/client_cert.crt"
  ssl.key: "/etc/ssl/client_key.key"
  ssl.supported_protocols: ["TLSv1.2"]
```

**_THIS DOES NOT WORK_**

```auto
#========================== Modules configuration ============================
metricbeat.modules:
#------------------------------- System Module -------------------------------
- module: system
  metricsets:
    # CPU stats
    - cpu
    # System Load stats
    - load
    # Per filesystem stats
    - filesystem
    # Per process stats
    - process
  enabled: true
  period: 30s
  processes: ['.*']
  processors:
    - drop_event:
        when:
          or:
            - regexp:
                mount_point: '^/(run|sys|proc|dev)'
            - regexp:
                device_name: '^10.69.69'
            - equals:
                device_name: sunrpc
#================================ General =====================================
name: metricbeat
#================================ Outputs =====================================
#-------------------------- logstash output ------------------------------
output.logstash:
  hosts: ["logstash:5045"]
  ssl.certificate_authorities: ["/etc/ssl/ca-chain.crt"]
  ssl.certificate: "/etc/ssl/client_cert.crt"
  ssl.key: "/etc/ssl/client_key.key"
  ssl.supported_protocols: ["TLSv1.2"]
```

The only thing different is using "filters:" instead of "processors:" makes it work

Also, in case any one asks.... configtest passes with processors in it

```auto
[root@web10 ~]# /usr/share/metricbeat/bin/metricbeat -c /etc/metricbeat/metricbeat.yml -configtest
Config OK
```

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [January 11, 2017, 9:48am UTC](https://discuss.elastic.co/t/processors-drop-event-no-worky/70970/4 "2017-01-11T09:48:17Z")

</div>

Thanks for sharing the full config. Inside the modules it is called filters, on a global level it is called processors. This is for historical reason. We already had some discussions in the past about this on how to resolves this but there was not final conclusion / fix yet. @dedemorton FYI

About configtest passing: We can't detect currently fields which are "too much" with config test.

---

<div class="post-metadata">

**Author:** ![panaman](https://avatars.discourse-cdn.com/v4/letter/p/3da27b/32.png) [@panaman](https://discuss.elastic.co/u/panaman)\
**Post date:** [January 11, 2017, 1:36pm UTC](https://discuss.elastic.co/t/processors-drop-event-no-worky/70970/5 "2017-01-11T13:36:02Z")

</div>

maybe you guys should change the documentation

---

<div class="post-metadata">

**Author:** ![panaman](https://avatars.discourse-cdn.com/v4/letter/p/3da27b/32.png) [@panaman](https://discuss.elastic.co/u/panaman)\
**Post date:** [January 11, 2017, 8:35pm UTC](https://discuss.elastic.co/t/processors-drop-event-no-worky/70970/6 "2017-01-11T20:35:38Z")

</div>

Ok, I figured more out with processors....  
This config filtering works using "processors:"

```auto
#========================== Modules configuration ============================
metricbeat.modules:
#------------------------------- System Module -------------------------------
- module: system
  metricsets:
    # CPU stats
    - cpu
    # System Load stats
    - load
    # Per filesystem stats
    - filesystem
    # Per process stats
    - process
  enabled: true
  period: 30s
  processes: ['.*']
#================================ Processors ==================================
processors:
  - drop_event:
      when:
        or: 
          - regexp:
              system.filesystem.mount_point: '^/(run|sys|proc|dev)'
          - regexp:
              system.filesystem.device_name: '^10.69.69'
          - equals:
              system.filesystem.device_name: sunrpc
          - and:
              - equals:
                  metricset.name: process
              - not:
                  regexp:
                    system.process.cmdline: '.*'
#================================ General =====================================
name: metricbeat
#================================ Outputs =====================================
#-------------------------- logstash output ------------------------------
output.logstash:
  hosts: ["logstash:5045"]
  ssl.certificate_authorities: ["/etc/ssl/ca-chain.crt"]
  ssl.certificate: "/etc/ssl/client_cert.crt"
  ssl.key: "/etc/ssl/client_key.key" 
  ssl.supported_protocols: ["TLSv1.2"]
```

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [January 12, 2017, 9:36am UTC](https://discuss.elastic.co/t/processors-drop-event-no-worky/70970/7 "2017-01-12T09:36:37Z")

</div>

Yes. Did it with filters local to modules not work?

---

<div class="post-metadata">

**Author:** ![panaman](https://avatars.discourse-cdn.com/v4/letter/p/3da27b/32.png) [@panaman](https://discuss.elastic.co/u/panaman)\
**Post date:** [January 12, 2017, 7:53pm UTC](https://discuss.elastic.co/t/processors-drop-event-no-worky/70970/8 "2017-01-12T19:53:25Z")

</div>

using the last config enables more granular filtering because of the field names "system.filesystem"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 9, 2017, 7:53pm UTC](https://discuss.elastic.co/t/processors-drop-event-no-worky/70970/9 "2017-02-09T19:53:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.