Config not working, Injecting all logs

Elastic Stack Beats
1

Hi Guys,

For some reason... Winlogbeat is grabbing all security logs not just the one listed below, any idea what I'm missing ?, Running 7.5.1

Thx!

 winlogbeat.event_logs:
  • name: Security
    processors:
    • drop_event.when.not.or:
      • equals.winlog.event_id: 4754
      • equals.winlog.event_id: 4755
      • equals.winlog.event_id: 4757
      • equals.winlog.event_id: 4758
      • equals.winlog.event_id: 4764
      • equals.winlog.event_id: 4740
      • equals.winlog.event_id: 4728
      • equals.winlog.event_id: 4732
      • equals.winlog.event_id: 4756
      • equals.winlog.event_id: 4735
      • equals.winlog.event_id: 4724
      • equals.winlog.event_id: 4625
      • equals.winlog.event_id: 4648
      • equals.winlog.event_id: 1102
      • equals.winlog.event_id: 4624
      • equals.winlog.event_id: 5038
      • equals.winlog.event_id: 6281
      • equals.winlog.event_id: 4727
      • equals.winlog.event_id: 4729
      • equals.winlog.event_id: 4730
      • equals.winlog.event_id: 4731
      • equals.winlog.event_id: 4733
      • equals.winlog.event_id: 4734
      • equals.winlog.event_id: 4737
        #ignore_older: 72h
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.