The 'drop_event' filter (Filebeat) is leaking events?

Question

I have a filebeat module for Fortinet firewall logs. Trying to filter out most of the non-relevant logs I cannot accomplish it properly.

I want to filter out the logs