Skip to main content

Drop

Filter Elastic Compatible

Synopsis​

Conditionally stops processing of a document by dropping it from the pipeline.

Schema​

- drop:
    if: <script>
    filter: <script>
    description: <text>
    tag: <string>

Configuration​

The following fields are used to define the processor:

FieldRequiredDefaultDescription
ifN-Condition that determines whether to drop the document
filterN-Cribl-style JavaScript truthiness expression evaluated after if. A falsy result silently skips the processor, leaving the document in the pipeline. Distinct from if, which uses the native expression language
descriptionN-Explanatory note
tagN-Identifier
disabledNfalseWhen true, the processor is skipped and the event continues to the next one. Lets you take a processor out of the path without removing its configuration
note

This processor does not accept on_success, on_failure or ignore_failure. Its whole job is to signal a control-flow decision to the pipeline runner, and it returns that signal directly — there is no success or failure outcome for a handler to run against. if, tag and disabled work normally.

Details​

This processor is particularly useful for filtering out unwanted documents based on their content or metadata without raising exceptions.

Common uses are filtering debug logs, excluding health checks, and dropping internal traffic.

warning

Once dropped, a document cannot be recovered by the subsequent processors. Use caution with complex conditions to avoid accidentally dropping important documents.

Examples​

Basic​

Dropping documents with a specific packet count...

{
  "source": {
    "packets": 10
  }
}
- drop:
    if: ctx.source.packets == 10

removes them from the pipeline:

Document dropped from pipeline

Multiple Conditions​

Specifying multiple criteria...

{
  "user": {
    "role": "guest",
    "access_level": 1
  }
}
- drop:
    if: ctx.user.role == 'guest' && ctx.user.access_level < 2
    description: "Drop low-privilege guest access"

filters out documents that meet the combined conditions:

Document dropped from pipeline

Complex Filtering​

Using complex conditions...

{
  "http": {
    "request": {
      "method": "GET",
      "path": "/health",
      "source_ip": "10.0.0.1"
    }
  }
}
- drop:
    if: >
        ctx.http?.request?.method == 'GET' &&
        ctx.http.request.path == '/health' &&
        ctx.http.request.source_ip.startsWith('10.')
    description: "Drop internal health checks"

filters out those traffic patterns:

Document dropped from pipeline

Error Handling​

A condition that does not match leaves the document in the pipeline: evaluateCondition returns the skip sentinel and drop never reaches its drop signal. If the condition cannot be evaluated at all, the evaluation error is returned to the pipeline runner instead, and the document is again not dropped.

drop accepts no ignore_failure, so neither outcome can be suppressed from the processor itself. Guard the condition instead — check that the field exists before testing its value.