# Unable to create a proper processor for windows module to filter certain services

**URL:** <https://discuss.elastic.co/t/unable-to-create-a-proper-processor-for-windows-module-to-filter-certain-services/240330>\
**Category:** Beats\
**Tags:** windows, metricbeat\
**Created:** [July 8, 2020, 11:13am UTC](https://discuss.elastic.co/t/unable-to-create-a-proper-processor-for-windows-module-to-filter-certain-services/240330 "2020-07-08T11:13:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![yankun0567](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yankun0567/32/71796_2.png) [@yankun0567](https://discuss.elastic.co/u/yankun0567)\
**Post date:** [July 8, 2020, 11:13am UTC](https://discuss.elastic.co/t/unable-to-create-a-proper-processor-for-windows-module-to-filter-certain-services/240330/1 "2020-07-08T11:13:25Z")

</div>

Hi,

I'm currently evaluating metricbeat for monitoring our systems. On windows I would like to only monitor services, which are started automatically (or delayed) except a few services which are ok to be stopped, even if started automatically.

So I thought it would be a piece of cake, to write an processor for the windows module config file. Here it what it looks like:

```auto
  - module: windows
      metricsets:
        - service
      period: 2m
      processors:
        - drop_event:
            when:
              or:
                - not:
                  contains:
                    windows.service.start_type: "Automatic"
                - equals:
                  windows.service.name: "MapsBroker"
                - equals:
                  windows.service.name: "sppsvc"
                - equals:
                  windows.service.name: "RemoteRegistry"
                - equals:
                  windows.service.name: "WbioSrvc"
                - equals:
                  windows.service.name: "SQLTELEMETRY$SQLEXPRESS"

```

But unfortunately this seems to be wrong, as I can see in the logs: Error creating runner from config: 1 error: failed to initialize condition: missing or invalid condition

But I can't figure out the error in my conditions. To me this looks like shown in the documentation. Can anybody help me on this? Tanks!

---

<div class="post-metadata">

**Author:** ![yankun0567](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yankun0567/32/71796_2.png) [@yankun0567](https://discuss.elastic.co/u/yankun0567)\
**Post date:** [July 8, 2020, 11:34am UTC](https://discuss.elastic.co/t/unable-to-create-a-proper-processor-for-windows-module-to-filter-certain-services/240330/2 "2020-07-08T11:34:46Z")

</div>

Ok, fixed it finally myself, be rewriting it like this:

```auto
- module: windows
  metricsets:
    - service
  period: 2m
  processors:
    - drop_event.when.or:
      - not.contains.windows.service.start_type: "Automatic"
      - equals.windows.service.name: "MapsBroker"
      - equals.windows.service.name: "sppsvc"
      - equals.windows.service.name: "RemoteRegistry"
      - equals.windows.service.name: "WbioSrvc"
      - equals.windows.service.name: "SQLTELEMETRY$SQLEXPRESS"

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 5, 2020, 1:34pm UTC](https://discuss.elastic.co/t/unable-to-create-a-proper-processor-for-windows-module-to-filter-certain-services/240330/3 "2020-08-05T13:34:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.