# Elasticsearch filter plugin and winlogbeat

**URL:** <https://discuss.elastic.co/t/elasticsearch-filter-plugin-and-winlogbeat/273794>\
**Category:** Logstash\
**Created:** [May 24, 2021, 8:31am UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-and-winlogbeat/273794 "2021-05-24T08:31:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![fabryx87](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fabryx87/32/88165_2.png) [@fabryx87](https://discuss.elastic.co/u/fabryx87)\
**Post date:** [May 24, 2021, 8:31am UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-and-winlogbeat/273794/1 "2021-05-24T08:31:39Z")

</div>

Goodmorning everyone,

I am trying to use for the firts time the elasticsearch filter plugin for logstash.

I am trying to searching the login event whenever you the log off event and enrich the log off event with necessary information from login event.  
the event id is the field [winlog][event\_data][TargetLoginId] and is shared between logon and logoff events.  
the configuration starts, but it doesn't copy the selected fields.

```auto

if "dc" in [tags] {

      if [winlog][event_id] == 4634 or [event][code] == 4647 {

        elasticsearch {

          index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"

          hosts => ["http://localhost:9200"]

          user => elastic

          password => changeme

          query => "legittima:yes AND [winlog][event_data][TargetLoginId]:%{[winlog][event_data][TargetLoginId]}"

          fields => { 

            "[winlog][event_data][ElevatedToken]" => "elevated_token"

            "@timestamp" => "LoginTime"

           }

        }

```

the match is: query =\> "legittima:yes AND [winlog][event\_data][TargetLoginId]:%{[winlog][event\_data][TargetLoginId]}"

if the field is set to yes, and the [winlog][event\_data][TargetLoginId] is the same of the current one, copy the fields.

thanks

---

<div class="post-metadata">

**Author:** ![fabryx87](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fabryx87/32/88165_2.png) [@fabryx87](https://discuss.elastic.co/u/fabryx87)\
**Post date:** [May 28, 2021, 7:43am UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-and-winlogbeat/273794/2 "2021-05-28T07:43:00Z")

</div>

Up please

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 25, 2021, 7:43am UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-and-winlogbeat/273794/3 "2021-06-25T07:43:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.