drop.md

applies_to	serverless stack ga ga 9.3+
products	id observability id elasticsearch id kibana id cloud-serverless id cloud-hosted id cloud-enterprise id cloud-kubernetes id elastic-stack
description	Prevent documents from being indexed when they meet a condition with the Streams drop document processor in Streamlang.

Drop document processor [streams-drop-processor]

The Drop document processor prevents documents from being indexed when they meet a specific condition, without raising an error.

To configure a condition for dropping documents:

1. Select Create → Create processor.
2. Select Drop document from the Processor menu.
3. Set the Condition for when you want to drop a document.

:::{warning} The default is the always condition. Not setting a specific condition results in every document that matches the drop condition getting dropped from indexing. :::

This functionality uses the {{es}} Drop processor internally, but you configure it in Streamlang. Streamlang doesn't always have 1:1 parity with the ingest processor options and behavior. Refer to Processor limitations and inconsistencies.

YAML reference [streams-drop-yaml-reference]

In YAML mode, configure the drop document processor using the following parameters. For the complete Streamlang syntax, refer to the Streamlang reference.

The drop_document processor has no additional parameters beyond the common options. Use a where condition to specify when documents should be dropped.

- action: drop_document
  where:
    field: attributes.path
    eq: "/health"