WARNING: Version 5.3 of Winlogbeat has passed its EOL date.

This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.

« decode_json_fields drop_fields »
Elastic Docs ›Winlogbeat Reference [5.3] ›Configuring Winlogbeat ›Processors

drop_event

edit

drop_event

edit

The drop_event processor drops the entire event if the associated condition is fulfilled. The condition is mandatory, because without one, all the events are dropped.

processors:
 - drop_event:
     when:
        condition

See Conditions for a list of supported conditions.

« decode_json_fields drop_fields »