I'm looking to collect specific System events. I would like all error and warning events. Only 36880 information events. And finally ignore older than 72 hours. This code checks out but still including information events outside 36880. Warning and Errors are still being collected as intended.
- name: System ignore_older: 72h processors: - drop_event.when.and: - equals.level: information - not.equals.event_id: 36880