This is a filter that lets you completely drop an event and can be used both during queries and within the parser pipeline. When the event is dropped it is removed entirely, either during parsing, which means it is not ingested into LogScale, or within a query, where effectively removes the event from the query output.

Note

Takes no parameters

Examples

Prevent all events matching a particular field value from being ingested.

logscale
parseJson() | case { someField = "some_value" | dropEvent(); * } | parseTimestamp(field=@timestamp)