Trying to drop event if mount_point is /

Elastic Stack Beats
1

I have try all different kind of options but nothing seems to work.
anyone has doe this before. how do I do this?

processors:
- drop_event.when.equals:
system.filesystem.mount_point: '/'

processors:
- drop_event.when.equals:
system.filesystem.mount_point: "/"

processors:
- drop_event.when.equals:
system.filesystem.mount_point: [/]

and you name it

  • drop_event:
    when:
    equals:
    system.filesystem.mount_point: "/"
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.