I'm using the processer in the System integration on Elastic Agent to try and reduce the ingest as we get a lot of noise.
I've been doing some testing as I'd like to filter out an event code if the process name is x, I've been unsuccessful so far and have been trying to break it down to see where I'm going wrong.
I was able to successfully filter out the specific event code via:
- drop_event:
when:
equals:
event.code: "4688"
But trying to use process name is unsuccessful i.e. the events with the process.executable are still being logged/indexed:
For the benefit of anyone who comes across it, as I did a lot of searching trying to figure this out! Here is what I found out.
It looks like the issue was down to the process.name field not existing pre-parsing, I possibly would have come to this conclusion earlier if the event.code process had also failed.
So then I went down the rabbit hole of trying to work out what fields I could use and which ones I couldn't. This may be obvious information for a lot of people, particularly if you've come from Winlogbeat but for someone whose just started and is using the agent the documentation could be a LOT more helpful as I didn't see this mentioned in either the System Integration documentation or the Processor documentation which is linked in the integration.
Eventually I discovered you can reference the raw data names in the Windows Event XML and was able to accomplish what I needed with the following:
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.