Starting in version 7.16, this experimental functionality has been removed. You
should use the journald input in Filebeat instead.
Drop events
editDrop events
editThe drop_event processor drops the entire event if the associated condition
is fulfilled. The condition is mandatory, because without one, all the events
are dropped.
processors:
- drop_event:
when:
condition
See Conditions for a list of supported conditions.