# Save a variable for use in processors or how to drop later events in a series?
**URL:** https://discuss.elastic.co/t/save-a-variable-for-use-in-processors-or-how-to-drop-later-events-in-a-series/315406
**Category:** Beats
**Tags:** winlogbeat
**Created:** [September 28, 2022, 9:28pm UTC](https://discuss.elastic.co/t/save-a-variable-for-use-in-processors-or-how-to-drop-later-events-in-a-series/315406 "2022-09-28T21:28:56Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@opoplawski](https://discuss.elastic.co/u/opoplawski)
#### Post date: [September 28, 2022, 9:28pm UTC](https://discuss.elastic.co/t/save-a-variable-for-use-in-processors-or-how-to-drop-later-events-in-a-series/315406/1 "2022-09-28T21:28:56Z")
Is it possible to save state in a variable for use in a processor? I'd like to do something like:
```auto
- save_variable:
name: id
value: winlog.event_data.ScriptBlockId
when:
regexp:
winlog.event_data.ScriptBlockText: "ClassName = 'Root/Microsoft/Windows"
- drop_event:
when:
equals:
winlog.event_data.ScriptBlockId: $id
```
The idea being that if the first condition were true, we would save the value of the winlog.event\_data.ScriptBlockId element in the variable "id". Then if later events had winlog.event\_data.ScriptBlockId elements that equaled the value of the "id" variable we would discard them.
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [September 29, 2022, 2:48am UTC](https://discuss.elastic.co/t/save-a-variable-for-use-in-processors-or-how-to-drop-later-events-in-a-series/315406/2 "2022-09-29T02:48:15Z")
Processors are meant to be stateless so there are no features to save a value.
If you wanted to do a more complex logical comparison to determine whether or not to drop an event then you could use the `script` processor. But this is only to compare fields within a single event. If you are trying to compare values across multiple events then the stateless-ness of processors will be an issue.
---
### Author:  [@opoplawski](https://discuss.elastic.co/u/opoplawski)
#### Post date: [September 29, 2022, 2:00pm UTC](https://discuss.elastic.co/t/save-a-variable-for-use-in-processors-or-how-to-drop-later-events-in-a-series/315406/3 "2022-09-29T14:00:33Z")
Yeah, that's what I figured. Any other alternatives? Something in logstash? NXlog is able to save a value which has been helpful for this situation.
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [September 29, 2022, 4:30pm UTC](https://discuss.elastic.co/t/save-a-variable-for-use-in-processors-or-how-to-drop-later-events-in-a-series/315406/4 "2022-09-29T16:30:17Z")
You could use the `script` processor across threads if you set `max_cached_sessions: 1`. (See config [docs](https://www.elastic.co/guide/en/beats/filebeat/current/processor-script.html).) This would mean that there is only a single instance of the VM. So if you did store some state as a global variable it would be there for the next event when it is processed. My only caution is that because processors are meant to be stateless that his behavior could break at some point in the future.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 27, 2022, 6:30pm UTC](https://discuss.elastic.co/t/save-a-variable-for-use-in-processors-or-how-to-drop-later-events-in-a-series/315406/5 "2022-10-27T18:30:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.