Hey, I'm trying to define a processor in the system module just for syslog to drop certain spammy, non-relevant events. But when I define a drop_event I get an error about a processor having multiple actions:
#011ERROR#011fileset/factory.go:105#011Error creating input: each processor must have exactly one action, but found 2 actions (add_locale,drop_event)
According to the documentation that should be a valid location: https://www.elastic.co/guide/en/beats/filebeat/current/defining-processors.html#where-valid
I also tried defining it in the modules top scope which failed with "Fileset system/input is configured but doesn't exist"
I'd rather avoid defining the processor at top scope since I have other inputs where this filter would just cause unnecessary computation.
Any help for this would be appreciated.
- module: system # Syslog syslog: enabled: true input: processors: - drop_event: when: and: - contains: message: "error on subcontainer" - contains: message: "ia_addr" # Authorization logs auth: enabled: true