# Convert winlogbeat drop to integration custom config

**URL:** <https://discuss.elastic.co/t/convert-winlogbeat-drop-to-integration-custom-config/368102>\
**Category:** Elastic Agent\
**Created:** [October 1, 2024, 5:39pm UTC](https://discuss.elastic.co/t/convert-winlogbeat-drop-to-integration-custom-config/368102 "2024-10-01T17:39:49Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [October 1, 2024, 5:39pm UTC](https://discuss.elastic.co/t/convert-winlogbeat-drop-to-integration-custom-config/368102/1 "2024-10-01T17:39:49Z")

</div>

I have what was a simple winlogbeat drop:

- drop\_event.when:  
and:  
- equals.event\_id: 4688  
- contains.message: "New Process Name"  
- contains.message: "splunk"

I can't figure out in the doc how to put the equivalent in the custom windows event logs "custom configuration" field. It seems it should work there, but the link to conditional shows very confusing syntax.