# Setup logs only record with certain condition

**URL:** <https://discuss.elastic.co/t/setup-logs-only-record-with-certain-condition/371683>\
**Category:** Elastic Observability\
**Created:** [December 9, 2024, 8:41am UTC](https://discuss.elastic.co/t/setup-logs-only-record-with-certain-condition/371683 "2024-12-09T08:41:22Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![dhanyn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dhanyn/32/139808_2.png) [@dhanyn](https://discuss.elastic.co/u/dhanyn)\
**Post date:** [December 9, 2024, 8:41am UTC](https://discuss.elastic.co/t/setup-logs-only-record-with-certain-condition/371683/1 "2024-12-09T08:41:22Z")

</div>

hello. Im new in elk stack, i want to ask regarding requirements about how to reduce logs so elk service will only retrieve data if one of the some fields are not empty.

this is what i've done but not working yet

```auto
processors:
  - drop_event:
      when:
        and:
          - not:
              has_fields: ["auditd.log.SGID", "process.executable", "process.args"]

```

expected  
elk will only collect logs if at least one of 3 fields above are not empty. Otherwise, it will not recorded.