# Discarding logs in elk
**URL:** https://discuss.elastic.co/t/discarding-logs-in-elk/307481
**Category:** Beats
**Tags:** winlogbeat
**Created:** [June 17, 2022, 7:19am UTC](https://discuss.elastic.co/t/discarding-logs-in-elk/307481 "2022-06-17T07:19:10Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@ashisharyan](https://discuss.elastic.co/u/ashisharyan)
#### Post date: [June 17, 2022, 7:19am UTC](https://discuss.elastic.co/t/discarding-logs-in-elk/307481/1 "2022-06-17T07:19:10Z")
We are using winlogbeat agent.
Can we discard or drop log messages based on a criteria defined in elk stack.
We dont want to drop logs based on winlog yml config on systems but
we want to drop logs centrally.Is it possible.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [June 17, 2022, 7:28am UTC](https://discuss.elastic.co/t/discarding-logs-in-elk/307481/2 "2022-06-17T07:28:01Z")
> [@ashisharyan](#):
>
> We dont want to drop logs based on winlog yml config on systems
Why not? It seems a waste to ship them and drop them.
---
### Author:  [@ashisharyan](https://discuss.elastic.co/u/ashisharyan)
#### Post date: [June 17, 2022, 7:37am UTC](https://discuss.elastic.co/t/discarding-logs-in-elk/307481/3 "2022-06-17T07:37:46Z")
there is some policy deployed which does not allow to create these config files on various hosts thats why was looking at other option
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [June 20, 2022, 12:24am UTC](https://discuss.elastic.co/t/discarding-logs-in-elk/307481/4 "2022-06-20T00:24:33Z")
Ok. You could send all the logs to another Winlogbeat instance and drop them there.
---
### Author:  [@rugenl](https://discuss.elastic.co/u/rugenl)
#### Post date: [June 20, 2022, 1:45am UTC](https://discuss.elastic.co/t/discarding-logs-in-elk/307481/5 "2022-06-20T01:45:48Z")
Use an ingest pipeline DROP
---
### Author:  [@ashisharyan](https://discuss.elastic.co/u/ashisharyan)
#### Post date: [June 20, 2022, 5:44am UTC](https://discuss.elastic.co/t/discarding-logs-in-elk/307481/6 "2022-06-20T05:44:34Z")
Hi Rugenl,
Do you mean to create ingest pipeline DROP on winlogbeat or Elastic?
Can you please share few examples if feasible
Regards
Ashish
---
### Author:  [@ashisharyan](https://discuss.elastic.co/u/ashisharyan)
#### Post date: [June 20, 2022, 5:59am UTC](https://discuss.elastic.co/t/discarding-logs-in-elk/307481/7 "2022-06-20T05:59:17Z")
Ok.Thanks
---
### Author:  [@rugenl](https://discuss.elastic.co/u/rugenl)
#### Post date: [June 21, 2022, 3:28am UTC](https://discuss.elastic.co/t/discarding-logs-in-elk/307481/8 "2022-06-21T03:28:33Z")
Starting in 8.0.0, winlogbeat ships ingest pipelines. I haven't switched my winlogbeat agents to 8 yet, but I have loaded the ingest pipelines. I think all winlogbeat events are sent to ingest pipeline winlogbeat-{agent.version}-routing, then some events are sent to other pipelines from there. You could add your drop logic by modifying that pipeline.
If you're pre 8.x, you would have to create an ingest pipeline and change your winlogbeat to specify that ingext pipeline.
Some links:
> **[Winlogbeat and pipelines and painless scripts, oh my!](http://ramblingcookiemonster.github.io/winlogbeat-pipeline/)**
>
> “painless”
> **[Elasticsearch Ingest Pipeline 101: Usage & Setup Made Easy - Learn | Hevo](https://hevodata.com/learn/elasticsearch-ingest-pipeline/)**
>
> This article provides you with a comprehensive guide to effectively create, test & manage ElasticSearch Ingest Pipelines.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 19, 2022, 3:28am UTC](https://discuss.elastic.co/t/discarding-logs-in-elk/307481/9 "2022-07-19T03:28:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.