Processors drop_event - no worky

Elastic Stack Beats
3

THIS WORKS

#==========================  Modules configuration ============================
metricbeat.modules:
#------------------------------- System Module -------------------------------
- module: system
  metricsets:
    # CPU stats
    - cpu
    # System Load stats
    - load
    # Per filesystem stats
    - filesystem
    # Per process stats
    - process
  enabled: true
  period: 30s
  processes: ['.*']
  filters:
    - drop_event:
        when:
          or:
            - regexp:
                mount_point: '^/(run|sys|proc|dev)'
            - regexp:
                device_name: '^10.69.69'
            - equals:
                device_name: sunrpc
#================================ General =====================================
name: metricbeat
#================================ Outputs =====================================
#-------------------------- logstash output ------------------------------
output.logstash:
  hosts: ["logstash:5045"]
  ssl.certificate_authorities: ["/etc/ssl/ca-chain.crt"]
  ssl.certificate: "/etc/ssl/client_cert.crt"
  ssl.key: "/etc/ssl/client_key.key"
  ssl.supported_protocols: ["TLSv1.2"]

THIS DOES NOT WORK

#==========================  Modules configuration ============================
metricbeat.modules:
#------------------------------- System Module -------------------------------
- module: system
  metricsets:
    # CPU stats
    - cpu
    # System Load stats
    - load
    # Per filesystem stats
    - filesystem
    # Per process stats
    - process
  enabled: true
  period: 30s
  processes: ['.*']
  processors:
    - drop_event:
        when:
          or:
            - regexp:
                mount_point: '^/(run|sys|proc|dev)'
            - regexp:
                device_name: '^10.69.69'
            - equals:
                device_name: sunrpc
#================================ General =====================================
name: metricbeat
#================================ Outputs =====================================
#-------------------------- logstash output ------------------------------
output.logstash:
  hosts: ["logstash:5045"]
  ssl.certificate_authorities: ["/etc/ssl/ca-chain.crt"]
  ssl.certificate: "/etc/ssl/client_cert.crt"
  ssl.key: "/etc/ssl/client_key.key"
  ssl.supported_protocols: ["TLSv1.2"]

The only thing different is using "filters:" instead of "processors:" makes it work

Also, in case any one asks.... configtest passes with processors in it

[root@web10 ~]# /usr/share/metricbeat/bin/metricbeat -c /etc/metricbeat/metricbeat.yml -configtest
Config OK