# Processors drop\_event not correct (AND/OR)
**URL:** https://discuss.elastic.co/t/processors-drop-event-not-correct-and-or/84580
**Category:** Beats
**Tags:** packetbeat
**Created:** [May 4, 2017, 2:36pm UTC](https://discuss.elastic.co/t/processors-drop-event-not-correct-and-or/84580 "2017-05-04T14:36:09Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@rschirin](https://discuss.elastic.co/u/rschirin)
#### Post date: [May 4, 2017, 2:36pm UTC](https://discuss.elastic.co/t/processors-drop-event-not-correct-and-or/84580/1 "2017-05-04T14:36:09Z")
Hi,
I was trying to use this configuration but it's not dropping events:
```
processors:
- drop_event:
when:
and:
- not:
equals:
dest.ip: "1.2.3.4.5"
- not:
equals:
dest.port: 22
```
essentially, I would like to send to my logstash only the tcp packages where the dest.ip is "1.2.3.4.5" and dest.port is 22.
What am I doing wrong?
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [May 4, 2017, 2:57pm UTC](https://discuss.elastic.co/t/processors-drop-event-not-correct-and-or/84580/2 "2017-05-04T14:57:24Z")
Is dest.port a string in the event? If so then it needs to have quotes the config.
Using a custom BPF filter would be more efficient. [https://www.elastic.co/guide/en/beats/packetbeat/current/configuration-interfaces.html#\_bpf\_filter](https://www.elastic.co/guide/en/beats/packetbeat/current/configuration-interfaces.html#_bpf_filter)
---
### Author:  [@rschirin](https://discuss.elastic.co/u/rschirin)
#### Post date: [May 4, 2017, 3:08pm UTC](https://discuss.elastic.co/t/processors-drop-event-not-correct-and-or/84580/3 "2017-05-04T15:08:29Z")
dest.port is a number. I think it's a problem of my code since if I try this code:
```
processors:
- drop_event:
when:
not:
equals:
dest.port: 22
```
it works correctly.
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [May 4, 2017, 3:50pm UTC](https://discuss.elastic.co/t/processors-drop-event-not-correct-and-or/84580/4 "2017-05-04T15:50:45Z")
> [@rschirin](#):
>
> only the tcp packages where the dest.ip is "1.2.3.4.5" and dest.port is 22
I didn't look at logic initally, but that statement would be `!(dest.ip == 1.2.3.4 && dest.port == 22)`.
```auto
processors:
- drop_event.when.not:
and:
- equals.dest.ip: "1.2.3.4"
- equals.dest.por: 22
```
which I think is the same result as running these two processors:
```auto
processors:
- drop_event.when.not.equals.dest.ip: "1.2.3.4"
- drop_event.when.not.equals.dest.port: 22
```
But again, putting this into a BPF filter would be much better.
```auto
packetbeat.interfaces.bpf_filter: host 1.2.3.4 and port 22
```
---
### Author:  [@rschirin](https://discuss.elastic.co/u/rschirin)
#### Post date: [May 4, 2017, 5:09pm UTC](https://discuss.elastic.co/t/processors-drop-event-not-correct-and-or/84580/5 "2017-05-04T17:09:16Z")
The logic mechanism that you suspected is exact. I Will try it to give you a feedback,but thank you for the answer.
Personnal note: the syntax with dot char is more clear and easy of indent usage but I didn't find any reference in the 5.3 guide. Was My fault I guess
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 1, 2017, 5:16pm UTC](https://discuss.elastic.co/t/processors-drop-event-not-correct-and-or/84580/6 "2017-06-01T17:16:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.