How do I block a process ID?

[troywjonescc]

How do I block a Process ID for winhostmon.  This is what I have in inputs.conf

[WinHostMon://Process]

interval = 600

disabled = 0

type = process

blacklist = ProcessId="0"

index = windows

[troywjonescc]

Thank You I will look at that.

[richgalloway · Accepted solution]

blacklist is not valid option to WinHostMon.  Consider using an Ingest Action to discard the unwanted events.

[troywjonescc]

Will using the ingest action to drop those events keep that data from counting against my daily ingest limit or will it just not show up in searches but still ingest the data?

[richgalloway]

Events that are dropped (not indexed) for any reason do not count against your ingest license.