[[filtering-and-enhancing-data]]
== Filter and enhance data with processors

++++
<titleabbrev>Processors</titleabbrev>
++++

include::{libbeat-dir}/processors.asciidoc[]

For example, the following filter configuration drops a few fields that are rarely used (`provider_guid`, `process_id`, `thread_id`, and `version`) and one nested field, `event_data.ErrorSourceTable`:

[source, yaml]
-----------------------------------------------------
processors:
  - drop_fields:
      fields: [winlog.provider_guid, winlog.process.pid, winlog.process.thread.id, winlog.version, winlog.event_data.ErrorSourceTable]
-----------------------------------------------------

include::{libbeat-dir}/processors-using.asciidoc[]

