# Trying to drop Metricbeat events in Logstash

**URL:** <https://discuss.elastic.co/t/trying-to-drop-metricbeat-events-in-logstash/105095>\
**Category:** Logstash\
**Created:** [October 24, 2017, 4:08pm UTC](https://discuss.elastic.co/t/trying-to-drop-metricbeat-events-in-logstash/105095 "2017-10-24T16:08:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![fozboz](https://avatars.discourse-cdn.com/v4/letter/f/df788c/32.png) [@fozboz](https://discuss.elastic.co/u/fozboz)\
**Post date:** [October 24, 2017, 4:08pm UTC](https://discuss.elastic.co/t/trying-to-drop-metricbeat-events-in-logstash/105095/1 "2017-10-24T16:08:15Z")

</div>

This Metricbeat event is not indexable in ElasticSearch due to the  
"18446744073709551615" value.

```
{
  "@timestamp" => 2017-10-24T14:48:53.950Z,
  "system" => {
    "process" => {
      "memory" => {
        "share" => 0,
        "rss" => {
          "pct" => 0.0,
          "bytes" => 0
        },
        "size" => 0
      },
      "pgid" => 0,
      "name" => "host-0000",
      "pid" => 8529,
      "state" => "sleeping",
      "cgroup" => {
        "blkio" => {
          "path" => "/private/data",
          "total" => {
            "ios" => 240124,
            "bytes" => 4509523968
          },
          "id" => "privatedata"
        },
        "cpu" => {
          "path" => "/private/data",
          "cfs" => {
            "shares" => 1024,
            "period" => {
              "us" => 100000
            },
            "quota" => {
              "us" => 0
            }
          },
          "rt" => {
            "runtime" => {
              "us" => 0
            },
            "period" => {
              "us" => 0
            }
          },
          "id" => "emulator",
          "stats" => {
            "periods" => 0,
            "throttled" => {
              "periods" => 0,
              "ns" => 0
            }
          }
        },
        "memory" => {
          "path" => "/private/data",
          "mem" => {
            "limit" => {
              "bytes" => 18446744073709551615
            },
            "failures" => 0,
            "usage" => {
              "max" => {
                "bytes" => 5487312896
              },
              "bytes" => 4822638592
            }
          },
          "id" => "privatedata"
        },
      },
      "fd" => {
        "limit" => {
          "soft" => 1024,
          "hard" => 4096
        },
        "open" => 0
      },
      "username" => "root",
      "ppid" => 2
    }
  },
  "beat" => {
    "name" => "metrics",
    "hostname" => "myhost",
    "version" => "5.6.2"
  },
  "@version" => "1",
  "host" => "myhost",
  "metricset" => {
    "name" => "process",
    "rtt" => 185656,
    "module" => "system"
  },
  "type" => "metricsets",
  "tags" => [
    [0] "beats_input_raw_event"
  ]
}

```

I am trying to use a Logstash filter to drop the event. Using this guide [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html) to access the event data, I would have thought this would work:

```
filter {
  if [system][process][cgroup][memory][mem][limit][bytes] == "18446744073709551615" {
    drop {}
  }
}

```

But it doesn't. Does anyone know what is wrong with my config?

Thanks!

---

<div class="post-metadata">

**Author:** ![fozboz](https://avatars.discourse-cdn.com/v4/letter/f/df788c/32.png) [@fozboz](https://discuss.elastic.co/u/fozboz)\
**Post date:** [October 26, 2017, 2:36pm UTC](https://discuss.elastic.co/t/trying-to-drop-metricbeat-events-in-logstash/105095/2 "2017-10-26T14:36:32Z")

</div>

I've figured out what was wrong. The value 18446744073709551615 is a number and because I had quoted it, it would only match a string. Removed the quotes and it works 😁

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 23, 2017, 2:36pm UTC](https://discuss.elastic.co/t/trying-to-drop-metricbeat-events-in-logstash/105095/3 "2017-11-23T14:36:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.