The dropEvent() function can be used both during queries and within the parser pipeline. Depending on usage, the function has different behavior. If used during parsing, the event is dropped and removed entirely from the query output, meaning that the event data will not be stored in Falcon LogScale. If used within normal searching, the dropEvent() function is simply an alias for false - it behaves the same as false.

Note

The dropEvent() does not accept any arguments. The dropEvent() has different behaviour depending on usage in parser or in normal searches.

dropEvent() Examples

Click + next to an example below to get the full details.

Drop Events Based on Parsing JSON Value

Ignore Commented Lines During Parsing by Dropping Events