# Processors drop\_event - no worky

**URL:** <https://discuss.elastic.co/t/processors-drop-event-no-worky/70970>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [January 9, 2017, 4:37pm UTC](https://discuss.elastic.co/t/processors-drop-event-no-worky/70970 "2017-01-09T16:37:17Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![panaman](https://avatars.discourse-cdn.com/v4/letter/p/3da27b/32.png) [@panaman](https://discuss.elastic.co/u/panaman)\
**Post date:** [January 10, 2017, 1:23pm UTC](https://discuss.elastic.co/t/processors-drop-event-no-worky/70970/3 "2017-01-10T13:23:15Z")

</div>

**THIS WORKS**

```auto
#========================== Modules configuration ============================
metricbeat.modules:
#------------------------------- System Module -------------------------------
- module: system
  metricsets:
    # CPU stats
    - cpu
    # System Load stats
    - load
    # Per filesystem stats
    - filesystem
    # Per process stats
    - process
  enabled: true
  period: 30s
  processes: ['.*']
  filters:
    - drop_event:
        when:
          or:
            - regexp:
                mount_point: '^/(run|sys|proc|dev)'
            - regexp:
                device_name: '^10.69.69'
            - equals:
                device_name: sunrpc
#================================ General =====================================
name: metricbeat
#================================ Outputs =====================================
#-------------------------- logstash output ------------------------------
output.logstash:
  hosts: ["logstash:5045"]
  ssl.certificate_authorities: ["/etc/ssl/ca-chain.crt"]
  ssl.certificate: "/etc/ssl/client_cert.crt"
  ssl.key: "/etc/ssl/client_key.key"
  ssl.supported_protocols: ["TLSv1.2"]
```

**_THIS DOES NOT WORK_**

```auto
#========================== Modules configuration ============================
metricbeat.modules:
#------------------------------- System Module -------------------------------
- module: system
  metricsets:
    # CPU stats
    - cpu
    # System Load stats
    - load
    # Per filesystem stats
    - filesystem
    # Per process stats
    - process
  enabled: true
  period: 30s
  processes: ['.*']
  processors:
    - drop_event:
        when:
          or:
            - regexp:
                mount_point: '^/(run|sys|proc|dev)'
            - regexp:
                device_name: '^10.69.69'
            - equals:
                device_name: sunrpc
#================================ General =====================================
name: metricbeat
#================================ Outputs =====================================
#-------------------------- logstash output ------------------------------
output.logstash:
  hosts: ["logstash:5045"]
  ssl.certificate_authorities: ["/etc/ssl/ca-chain.crt"]
  ssl.certificate: "/etc/ssl/client_cert.crt"
  ssl.key: "/etc/ssl/client_key.key"
  ssl.supported_protocols: ["TLSv1.2"]
```

The only thing different is using "filters:" instead of "processors:" makes it work

Also, in case any one asks.... configtest passes with processors in it

```auto
[root@web10 ~]# /usr/share/metricbeat/bin/metricbeat -c /etc/metricbeat/metricbeat.yml -configtest
Config OK
```

---

_[View the full topic](https://discuss.elastic.co/t/processors-drop-event-no-worky/70970)._