title: Multiple regex matching in filebeat for message field
body: <p>I want to apply 2 regex expression with filebeat to drop events matching the content in message field.</p>
  <p>I am able to make it work for single regex condition, but I am not sure how to configure multiple regex conditions.</p>
  <p>regex list:</p>
  <ul>
  <li><code>message: &quot;(?i)cron&quot;</code></li>
  <li><code>message: &quot;^now ([0-9]{4})-([0-1][0-9])-([0-3][0-9])\s([0-1][0-9]|[2][0-3]):([0-5][0-9]):([0-5][0-9])$&quot;</code></li>
  </ul>
  <p>Following is the config I have done for single regex which will match &quot;cron&quot; case insensitive text anywhere in the message</p>
  <pre><code>- drop_event:
       when:
           regexp:
               message: &quot;(?i)cron&quot;
  </code></pre>
  <p>Refering to the Filebeat docs, I tried multiple configs but  then filebeat won't startup:</p>
  <ul>
  <li>Try 1:</li>
  </ul>
  <pre><code>- drop_event:
      or:
       - regexp:
          message: &quot;(?i)cron&quot;
       - regexp:
          message: &quot;^now ([0-9]{4})-([0-1][0-9])-([0-3][0-9])\s([0-1][0-9]|[2][0-3]):([0-5][0-9]):([0-5][0-9])$&quot;
  </code></pre>
  <ul>
  <li>Try 2:</li>
  </ul>
  <pre><code>- if:
      regexp:
        message: &quot;(?i)cron&quot;
    then:
      drop_event:
  - if:
      regexp:
        message: &quot;^now ([0-9]{4})-([0-1][0-9])-([0-3][0-9])\s([0-1][0-9]|[2][0-3]):([0-5][0-9]):([0-5][0-9])$&quot;
    then:
      drop_event: 
  </code></pre>