This is a filter that lets you completely drop an event and can be used both during queries and within the parser pipeline. When the event is dropped it is removed entirely, either during parsing, which means it is not ingested into LogScale, or within a query, where effectively removes the event from the query output.


Takes no parameters


Prevent all events matching a particular field value from being ingested.

parseJson() | case { someField = "some_value" | dropEvent(); * } | parseTimestamp(field=@timestamp)