# Winlogbeat 8.4 - Processors - Drop Event

**URL:** <https://discuss.elastic.co/t/winlogbeat-8-4-processors-drop-event/320160>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [November 30, 2022, 2:06pm UTC](https://discuss.elastic.co/t/winlogbeat-8-4-processors-drop-event/320160 "2022-11-30T14:06:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![prolle](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prolle/32/114049_2.png) [@prolle](https://discuss.elastic.co/u/prolle)\
**Post date:** [November 30, 2022, 2:06pm UTC](https://discuss.elastic.co/t/winlogbeat-8-4-processors-drop-event/320160/1 "2022-11-30T14:06:01Z")

</div>

Hi, i'm trying to drop an event from being sent to my elastic cluster.

On the Windows integration i have added a processor under the Windows Powershell channel and the Microsoft-Windows-Powershell/Operational channel.

The processor:

```auto
- drop_event:
    when:
      equals:
        source: "powershell.exe -Executionpolicy Bypass -File C:\\Script\\somescript.ps1"
    fields: ["process.command_line"]

```

But the in the agent logs i get the following error:

`Elastic Agent status changed to "error": "app filebeat--8.4.1-a53645b8: 1 error occurred:\n\t* 2 errors: Error creating runner from config: unexpected fields option in processors.2.drop_event;`

I guess i have something wrong in my processor, can someone point me in the right directions? Thanks.

---

<div class="post-metadata">

**Author:** ![prolle](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prolle/32/114049_2.png) [@prolle](https://discuss.elastic.co/u/prolle)\
**Post date:** [December 2, 2022, 2:28pm UTC](https://discuss.elastic.co/t/winlogbeat-8-4-processors-drop-event/320160/2 "2022-12-02T14:28:17Z")

</div>

I managed to solve this with the following

```auto
          - drop_event.when.not.or:
              - equals.process.command_line: 'powershell.exe -Executionpolicy Bypass -File C:\Script\somescript.ps1'

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 30, 2022, 4:28pm UTC](https://discuss.elastic.co/t/winlogbeat-8-4-processors-drop-event/320160/3 "2022-12-30T16:28:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.