# Drop Events By ID
**URL:** https://discuss.elastic.co/t/drop-events-by-id/192145
**Category:** Beats
**Tags:** winlogbeat
**Created:** [July 24, 2019, 9:51pm UTC](https://discuss.elastic.co/t/drop-events-by-id/192145 "2019-07-24T21:51:42Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@wwalker](https://discuss.elastic.co/u/wwalker)
#### Post date: [July 24, 2019, 9:51pm UTC](https://discuss.elastic.co/t/drop-events-by-id/192145/1 "2019-07-24T21:51:42Z")
Trying to drop events by their event\_id number but what I am using doesn't seem to be working. Where am I wrong at?
```auto
winlogbeat.event_logs:
- name: System
ignore_older: 72h
- name: Application
ignore_older: 72h
- name: Security
ignore_older: 72h
processors:
- drop_event.when.or:
- equals.event_id: 5156
- equals.event_id: 5145
```
---
### Author:  [@wwalker](https://discuss.elastic.co/u/wwalker)
#### Post date: [July 25, 2019, 4:28pm UTC](https://discuss.elastic.co/t/drop-events-by-id/192145/2 "2019-07-25T16:28:09Z")
I'm guessing because they've buried the event\_id field in an object, you can't condense statements into a single line or it thinks `winlog` is a condition instead of a part of a field name. Below is what is accepted and works:
```auto
winlogbeat.event_logs:
- name: System
ignore_older: 72h
- name: Application
ignore_older: 72h
- name: Security
ignore_older: 72h
processors:
- script:
lang: javascript
id: security
file: ${path.home}/module/security/config/winlogbeat-security.js
processors:
- drop_event:
when:
or:
- equals:
winlog.event_id: 5156
- equals:
winlog.event_id: 5145
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 22, 2019, 4:28pm UTC](https://discuss.elastic.co/t/drop-events-by-id/192145/3 "2019-08-22T16:28:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.