# Unable to write not equal condition with filebeat processor

**URL:** <https://discuss.elastic.co/t/unable-to-write-not-equal-condition-with-filebeat-processor/266934>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 11, 2021, 11:44am UTC](https://discuss.elastic.co/t/unable-to-write-not-equal-condition-with-filebeat-processor/266934 "2021-03-11T11:44:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sourabh\_Sharma1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sourabh_sharma1/32/80406_2.png) [@Sourabh\_Sharma1](https://discuss.elastic.co/u/Sourabh_Sharma1)\
**Post date:** [March 11, 2021, 11:44am UTC](https://discuss.elastic.co/t/unable-to-write-not-equal-condition-with-filebeat-processor/266934/1 "2021-03-11T11:44:36Z")

</div>

`

- dissect:  
tokenizer: '"%{pid|integer} - %{service.name} - %{service.status}"'  
field: "message"  
target\_prefix: ""
  - drop\_event:  
when:  
not:  
equals:  
pid|integer: "105"

## smaple logs:

"321 - App01 - WebServer is starting"  
"105 - App01 - WebServer is starting"  
"109 - App01 - WebServer is starting"  
"115 - App01 - WebServer is starting"

this single not equal works fine. when I apply it with or condition it is not work.

processors:  
#- add\_host\_metadata: ~  
#- add\_cloud\_metadata: ~  
#- add\_docker\_metadata: ~  
#- add\_kubernetes\_metadata: ~

- dissect:  
tokenizer: '"%{pid|integer} - %{service.name} - %{service.status}"'  
field: "message"  
target\_prefix: ""
- drop\_event:  
when:  
or:  
not:  
equals:  
pid|integer: "105"  
not:  
equals:  
pid|integer: "115"

* * *

2021-03-11T17:14:37.654+0530 INFO instance/beat.go:655 Beat ID: fecab980-bf36-4d77-a0b2-4fe49d64b99d  
2021-03-11T17:14:37.661+0530 INFO instance/beat.go:390 filebeat stopped.  
2021-03-11T17:14:37.661+0530 ERROR instance/beat.go:958 Exiting: error initializing processors: failed to initialize condition: missing or invalid condition  
Exiting: error initializing processors: failed to initialize condition: missing or invalid condition`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 8, 2021, 1:44pm UTC](https://discuss.elastic.co/t/unable-to-write-not-equal-condition-with-filebeat-processor/266934/2 "2021-04-08T13:44:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.