# Drop event does not work for specific field

**URL:** https://discuss.elastic.co/t/drop-event-does-not-work-for-specific-field/348535
**Category:** Beats
**Tags:** winlogbeat
**Created:** [December 4, 2023, 9:27am UTC](https://discuss.elastic.co/t/drop-event-does-not-work-for-specific-field/348535 "2023-12-04T09:27:13Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![s0p4L1n3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/s0p4l1n3/32/128200_2.png) [@s0p4L1n3](https://discuss.elastic.co/u/s0p4L1n3)
#### Post date: [December 4, 2023, 9:27am UTC](https://discuss.elastic.co/t/drop-event-does-not-work-for-specific-field/348535/1 "2023-12-04T09:27:13Z")

</div>

Hello,

I'm using Winlogbeat 7.17.13.0.

I want to monitor File/folder activities on the computers and servers.  
And I want to drop on the client side all useless/not needed events.

As monitoring files activites generate a big amount of logs, can overload the network if thousand of clients and fill the disk space in short time, this is a very important part.

```auto
- name: Security
     event_id: 4656, 4663, 4670, 4907
     ignore_older: 24h
     tags: [filesystem]
     processors:
       - script:
          lang: javascript
          id: security
          file: C:\Program Files\Graylog\sidecar\module\security\config\winlogbeat-security.js
       - drop_event.when.not.and:
            - equals.winlog.event_data.ObjectType: "File"
       - drop_event.when.or:
            - equals.winlog.event_data.winlog_task: "Authorization Policy Change"
            - equals.winlog.event_data.winlog_task: "Registry"
            - equals.winlog.event_data.winlog_task: "Kernel Object"
            - equals.winlog.event_data.SubjectUserSid: 'S-1-5-18'
            - equals.winlog.event_data.SubjectUserSid: 'S-1-5-19'
            - equals.winlog.event_data.AccessList: '%%1538'
            - equals.winlog.event_data.AccessList: '%%1538'
            - equals.winlog.event_data.AccessList: '%%1539'
            - equals.winlog.event_data.AccessList: '%%1541'
            - equals.winlog.event_data.AccessList: '%%1542'
            - equals.winlog.event_data.AccessList: '%%4416'
            - equals.winlog.event_data.AccessList: '%%4419'
            - equals.winlog.event_data.AccessList: '%%4420'
            - equals.winlog.event_data.AccessList: '%%4423'
            - equals.winlog.event_data.AccessList: '%%4424'

```

All the `- equals.winlog.event_data.AccessList` does not work and the event are still sent to the server.

Theses drop statement are working:

```auto
            - equals.winlog.event_data.winlog_task: "Authorization Policy Change"
            - equals.winlog.event_data.winlog_task: "Registry"
            - equals.winlog.event_data.winlog_task: "Kernel Object"
            - equals.winlog.event_data.SubjectUserSid: 'S-1-5-18'
            - equals.winlog.event_data.SubjectUserSid: 'S-1-5-19'

```

Theses are not working:

```auto
            - equals.winlog.event_data.AccessList: '%%1538'
            - equals.winlog.event_data.AccessList: '%%1538'
            - equals.winlog.event_data.AccessList: '%%1539'
            - equals.winlog.event_data.AccessList: '%%1541'
            - equals.winlog.event_data.AccessList: '%%1542'
            - equals.winlog.event_data.AccessList: '%%4416'
            - equals.winlog.event_data.AccessList: '%%4419'
            - equals.winlog.event_data.AccessList: '%%4420'
            - equals.winlog.event_data.AccessList: '%%4423'
            - equals.winlog.event_data.AccessList: '%%4424'

```

I tried the double quote, it not works either.

I double check the log format from Windows side and it correspond to my dropt event condition:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/4/34b511f0dfb50ebfc63d00cc6fcca03bec507601.png)

Is my syntax wrong ?

---

<div class="post-metadata">

### Author: ![s0p4L1n3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/s0p4l1n3/32/128200_2.png) [@s0p4L1n3](https://discuss.elastic.co/u/s0p4L1n3)
#### Post date: [December 4, 2023, 3:34pm UTC](https://discuss.elastic.co/t/drop-event-does-not-work-for-specific-field/348535/2 "2023-12-04T15:34:41Z")

</div>

I found the solution by myself, which is using **regexp** instead of **equals**

```auto
       - drop_event.when.or:
           - equals.winlog.event_data.winlog_task: "Authorization Policy Change"
           - equals.winlog.event_data.winlog_task: "Registry"
           - equals.winlog.event_data.winlog_task: "Kernel Object"
           - equals.winlog.event_data.SubjectUserSid: 'S-1-5-18'
           - equals.winlog.event_data.SubjectUserSid: 'S-1-5-19'
           - regexp.winlog.event_data.AccessList: '^%%4416.*'
           - regexp.winlog.event_data.AccessList: '^%%1538.*'
           - regexp.winlog.event_data.AccessList: '^%%1539.*'
           - regexp.winlog.event_data.AccessList: '^%%1541.*'
           - regexp.winlog.event_data.AccessList: '^%%1542.*'
           - regexp.winlog.event_data.AccessList: '^%%4419.*'
           - regexp.winlog.event_data.AccessList: '^%%4420.*'
           - regexp.winlog.event_data.AccessList: '^%%4421.*'
           - regexp.winlog.event_data.AccessList: '^%%4423.*'
           - regexp.winlog.event_data.AccessList: '^%%4424.*'
           - regexp.winlog.event_data.ObjectName: '^(?i)C\:\\Users\\[a-zA-Z0-9._-]+\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE.*'
           - regexp.winlog.event_data.ObjectName: '^(?i)C\:\\Users\\[a-zA-Z0-9._-]+\\AppData\\Roaming\\Microsoft\\Windows\Recent.*'
           - regexp.winlog.event_data.ObjectName: '^(?i)C\:\\\$Recycle.Bin.*'

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 1, 2024, 5:35pm UTC](https://discuss.elastic.co/t/drop-event-does-not-work-for-specific-field/348535/3 "2024-01-01T17:35:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.