# Drop Event Logs - By "Content"
**URL:** https://discuss.elastic.co/t/drop-event-logs-by-content/192761
**Category:** Beats
**Tags:** winlogbeat
**Created:** [July 29, 2019, 6:40pm UTC](https://discuss.elastic.co/t/drop-event-logs-by-content/192761 "2019-07-29T18:40:03Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Hotdog453](https://discuss.elastic.co/u/Hotdog453)
#### Post date: [July 29, 2019, 6:40pm UTC](https://discuss.elastic.co/t/drop-event-logs-by-content/192761/1 "2019-07-29T18:40:03Z")
Hello! So, we're looking to forward windows Firewall logs via WinLogBeat, into LogStash, for review/security. My desire is, however, to 'drop' 'known blocks'; that is, for example, we're going to block TCP 137. This is easy, it's doable, but the end result is we get a _ton_ of 137 blocks; this is expected, but I don't _want_ them; I know I'm dropping 137. I cannot, however, figure out how to block "CONTENT" of EventIDs. Here's my WinLogBeat config:
winlogbeat.event\_logs:
- name: Security
event\_id: 5031,5154,5155,5156,5157,5158,5159
level: critical, error, warning, information
ignore\_older: 48h
My struggle is the processor side, I've tried every variation I can think of, and we still get port 137. Here's what the resultant info looks like; scrubbed of any company info.
{"tags":["beats\_input\_codec\_plain\_applied"],"winlog":{"provider\_name":"Microsoft-Windows-Security-Auditing","channel":"Security","event\_data":{"LayerName":"%%14610","DestAddress":"10.206.101.255","ProcessID":"4","DestPort":"137","SourceAddress":"10.206.100.124","FilterRTID":"483314", **"SourcePort":"137"** ,"LayerRTID":"44","RemoteMachineID":"S-1-0-0","RemoteUserID":"S-1-0-0","Application":"System","Direction":"%%14592","Protocol":"17"},"computer\_name":"[COMPUTER.DOMAIN.NET](http://COMPUTER.DOMAIN.NET)","version":1,"task":"Filtering Platform Connection","record\_id":13006577,"process":{"pid":4,"thread":{"id":216}},"event\_id":5157,"provider\_guid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","api":"wineventlog","keywords":["Audit Failure"],"opcode":"Info"},"event":{"action":"Filtering Platform Connection","kind":"event","created":"2019-07-29T18:29:37.094Z","code":5157},"log":{"level":"information"},"@timestamp":"2019-07-29T18:29:35.988Z","ecs":{"version":"1.0.0"},"host":{"name":"LOH0015VPB4Q2","hostname":"COMPUTERNAME","architecture":"x86\_64","os":{"family":"windows","name":"Windows 10 Pro","kernel":"10.0.18362.267 (WinBuild.160101.0800)","platform":"windows","version":"10.0","build":"18362.267"},"id":"3e005dd5-f907-415c-a0e5-dcbe462d4660"},"agent":{"hostname":"COMPUTERNAME","version":"7.2.0","ephemeral\_id":"a51b70ff-fd2e-407e-b1c7-78abcea26f45","id":"b5ec3305-c70c-4a98-9916-1b8808c8a769","type":"winlogbeat"},"message":"The Windows Filtering Platform has blocked a connection.\n\nApplication Information:\n\tProcess ID:\t\t4\n\tApplication Name:\tSystem\n\nNetwork Information:\n\tDirection:\t\tInbound\n\tSource Address:\t\t10.206.100.124\n\t **Source Port:\t\t137** \n\tDestination Address:\t10.206.101.255\n\tDestination Port:\t\t137\n\tProtocol:\t\t17\n\nFilter Information:\n\tFilter Run-Time ID:\t483314\n\tLayer Name:\t\tReceive/Accept\n\tLayer Run-Time ID:\t44","@version":"1"}
My hope/desire is to filter off of either "SourcePort:137", or "Source Port:\t\t137"; I don't really care. Once I know how to filter off one, I can filter off others 🙂
Thanks!
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [July 29, 2019, 7:30pm UTC](https://discuss.elastic.co/t/drop-event-logs-by-content/192761/2 "2019-07-29T19:30:04Z")
Here's an example dropping events that have `DestPort` of `137`.
```auto
winlogbeat.event_logs:
- name: Security
event_id: 5031,5154,5155,5156,5157,5158,5159
processors:
- drop_event:
when:
equals.winlog.event_data.DestPort: "137"
```
And another example with an `and`.
```auto
winlogbeat.event_logs:
- name: Security
event_id: 5031,5154,5155,5156,5157,5158,5159
processors:
- drop_event:
when:
and:
- equals.winlog.event_data.Protocol: "17" #UDP
- equals.winlog.event_data.DestPort: "137"
```
- Conditions: [https://www.elastic.co/guide/en/beats/winlogbeat/7.2/defining-processors.html#conditions](https://www.elastic.co/guide/en/beats/winlogbeat/7.2/defining-processors.html#conditions)
---
### Author:  [@Hotdog453](https://discuss.elastic.co/u/Hotdog453)
#### Post date: [July 29, 2019, 7:59pm UTC](https://discuss.elastic.co/t/drop-event-logs-by-content/192761/3 "2019-07-29T19:59:33Z")
Looks logical! Unfortunately, that code verbose doesn't run; tosses an error of:
2019-07-29T15:58:58.831-0400 ERROR instance/beat.go:877 Exiting: Failed to create new event log. failed to initialize condition: missing or invalid condition
I'm possibly fubaring up the formatting when pasting it, because the logic does make sense to me!
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [July 29, 2019, 10:01pm UTC](https://discuss.elastic.co/t/drop-event-logs-by-content/192761/4 "2019-07-29T22:01:56Z")
Sorry I haven't tested them. I am going from memory.
I updated the examples. I think `when` expects a single object and I was giving it a list. The first example can also be written as (it's exactly the same to the Beat).
```auto
winlogbeat.event_logs:
- name: Security
event_id: 5031,5154,5155,5156,5157,5158,5159
processors:
- drop_event.when.equals.winlog.event_data.DestPort: "137"
```
---
### Author:  [@Hotdog453](https://discuss.elastic.co/u/Hotdog453)
#### Post date: [July 29, 2019, 11:08pm UTC](https://discuss.elastic.co/t/drop-event-logs-by-content/192761/5 "2019-07-29T23:08:47Z")
You're a good person, loved by all. Perfect. Went from 1000s of garbage events to none, that's perfect.
Thanks!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 26, 2019, 11:09pm UTC](https://discuss.elastic.co/t/drop-event-logs-by-content/192761/6 "2019-08-26T23:09:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.