# Can I filter the logs using event IDs?

**URL:** <https://discuss.elastic.co/t/can-i-filter-the-logs-using-event-ids/46639>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [April 7, 2016, 8:21am UTC](https://discuss.elastic.co/t/can-i-filter-the-logs-using-event-ids/46639 "2016-04-07T08:21:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![thyfere](https://avatars.discourse-cdn.com/v4/letter/t/48db29/32.png) [@thyfere](https://discuss.elastic.co/u/thyfere)\
**Post date:** [April 7, 2016, 8:21am UTC](https://discuss.elastic.co/t/can-i-filter-the-logs-using-event-ids/46639/1 "2016-04-07T08:21:17Z")

</div>

Hi,

I am shipping auditing logs from Windows boxes to Elasticsearch server. I want to ship only auditing logs from the computer, how can I do it using Winlogbeat?

---

<div class="post-metadata">

**Author:** ![mourlos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mourlos/32/10788_2.png) [@mourlos](https://discuss.elastic.co/u/mourlos)\
**Post date:** [April 7, 2016, 11:37am UTC](https://discuss.elastic.co/t/can-i-filter-the-logs-using-event-ids/46639/2 "2016-04-07T11:37:29Z")

</div>

You can use something like this (in version 5):

`
winlogbeat:
  event_logs:
    - name: Security
      include_xml: true
      level: info
      event_id: 4624, 4625, 4648, 4735, 4728, 4732, 4756, 4740
      provider:
        - Microsoft-Windows-Security-Auditing
`

You can also check this post [Winlogbeat - Select events by level, event\_id, and provider #1218](https://github.com/elastic/beats/issues/451)

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 7, 2016, 3:51pm UTC](https://discuss.elastic.co/t/can-i-filter-the-logs-using-event-ids/46639/3 "2016-04-07T15:51:45Z")

</div>

See the `event_logs.event_id` [documentation](https://www.elastic.co/guide/en/beats/winlogbeat/master/configuration-winlogbeat-options.html#_event_logs_event_id) for version 5.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 12, 2016, 1:52pm UTC](https://discuss.elastic.co/t/can-i-filter-the-logs-using-event-ids/46639/4 "2016-04-12T13:52:22Z")

</div>