Drop_event processor not working

[borna_talebi]

I have a proccessor to drop some events for a user. here is my config:

processors:
- drop_event:
    when:
      and:
      - or:
        - equals.event.code: 4658
        - equals.event.code: 4656
        - equals.event.code: 4634
        - equals.event.code: 4648
      - equals.event_data.SubjectUserName: "test-user$"

But it's not working. I've restarted the winlogbeat service too.
I'm using ELK 7.9 with winlogbeat 7.2

[andrewkroh]

@borna_talebi

equals.event_data.SubjectUserName

Does event_data.SubjectUserName field exist in any events you have? I think it should be winlog.event_data.SubjectUserName.

[borna_talebi]

@andrewkroh

winlog.event_data.SubjectUserName

It's winlog.event_data.SubjectUserName in my config. just a typo here.
I'm guessing the $ at the end is causing the problem.