# Filter :Active Directory Event **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [May 7, 2018, 8:29am UTC](https://discuss.elastic.co/t/filter-active-directory-event/130796 "2018-05-07T08:29:34Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Hanen](https://avatars.discourse-cdn.com/v4/letter/h/5f8ce5/32.png) [@Hanen](https://discuss.elastic.co/u/Hanen)\ **Post date:** [May 7, 2018, 8:29am UTC](https://discuss.elastic.co/t/filter-active-directory-event/130796/1 "2018-05-07T08:29:35Z")
Hello, Please how can I create a filter AD event on winlogbeat ?(security,application,system) I add some event id on each section but it doesn't work. Thank You. what I have written on winlogbeat.yml: Security:4634,4624-4625,4608-4609,4700-4800,4611,4616,4618,4621,4627, 4646-4649,4657,4662-4664,4670,4672-4674,4819,4825,4864-4902,4908,4913, 4928-4937,4946-4960,4964 Application:5038,5039,4668 System: 4648,4657,4760,4688-4689,4697-4699 ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [May 7, 2018, 10:30am UTC](https://discuss.elastic.co/t/filter-active-directory-event/130796/2 "2018-05-07T10:30:15Z")
Hi @Hanen, Can you please tell us which version of Winlogbeat are you using and share your `winlogbeat.yml` ? Enclose your configuration between triple-backticks: ``` ..configuration.. ``` so it gets properly formatted. ---
**Author:** ![Hanen](https://avatars.discourse-cdn.com/v4/letter/h/5f8ce5/32.png) [@Hanen](https://discuss.elastic.co/u/Hanen)\ **Post date:** [May 7, 2018, 10:40am UTC](https://discuss.elastic.co/t/filter-active-directory-event/130796/3 "2018-05-07T10:40:53Z")
Thanks for your replay, - version of winlogbeat: 6.2.2 My winlogbeat.yml like the following: ```auto winlogbeat.event_logs: - name: Application ignore_older: 24h event_id: 5038,5039,4668 - name: Security ignore_older: 24h event_id:4634,4624-4625,4608-4609,4700-4800,4611,4616,4618,4621,4627, 4646-4649,4657,4662-4664,4670,4672-4674,4819,4825,4864-4902,4908,4913, 4928-4937,4946-4960,4964 - name: System ignore_older: 24h event_id:4648,4657,4760,4688-4689,4697-4699 name: "NOM" output.logstash: hosts: ["@logstash:5044"] ``` Many thanks!!!!!!! ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [May 7, 2018, 11:39am UTC](https://discuss.elastic.co/t/filter-active-directory-event/130796/4 "2018-05-07T11:39:13Z")
The indenting in your configuration is wrong. `event_id` should have the same indentation as `ignore_older`: ```auto winlogbeat.event_logs: - name: Application ignore_older: 24h event_id: 5038,5039,4668 - name: Security ignore_older: 24h event_id:4634,4624-4625,4608-4609,4700-4800,4611,4616,4618,4621,4627,4646-4649,4657,4662-4664,4670,4672-4674,4819,4825,4864-4902,4908,4913,4928-4937,4946-4960,4964 - name: System ignore_older: 24h event_id:4648,4657,4760,4688-4689,4697-4699 ``` ---
**Author:** ![Hanen](https://avatars.discourse-cdn.com/v4/letter/h/5f8ce5/32.png) [@Hanen](https://discuss.elastic.co/u/Hanen)\ **Post date:** [May 7, 2018, 11:46am UTC](https://discuss.elastic.co/t/filter-active-directory-event/130796/5 "2018-05-07T11:46:13Z")
Yes in winlogbeat.yml event\_id have the same indentation as ignore\_older but it it doesn't work. in winlogbeat.log: **WARN EventLog[Security] Open() error. No events will be read from this source. The specified query is invalid** ---
**Author:** ![Hanen](https://avatars.discourse-cdn.com/v4/letter/h/5f8ce5/32.png) [@Hanen](https://discuss.elastic.co/u/Hanen)\ **Post date:** [May 7, 2018, 11:50am UTC](https://discuss.elastic.co/t/filter-active-directory-event/130796/6 "2018-05-07T11:50:00Z")
Can I create a processor like this? ```auto processors: - drop_event.when.and: - equals.log_name: Security - not.or: - equals.event_id: 4634 - equals.event_id: 4624-4625 - equals.event_id: 4608-4609 - equals.event_id: 4700-4800 - equals.event_id: 4611 - equals.event_id: 4616 - equals.event_id: 4618 - equals.event_id: 4621 - equals.event_id: 4627 - equals.event_id: 4646-4649 - equals.event_id: 4657 - equals.event_id: 4662-4664 - equals.event_id: 4670 - equals.event_id: 4672-4674 - equals.event_id: 4819 - equals.event_id: 4825 - equals.event_id: 4864-4902 - equals.event_id: 4908 - equals.event_id: 4913 - equals.event_id: 4928-4937 - equals.event_id: 4946-4960 - equals.event_id: 4964 ``` Is it true? thanks ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [May 7, 2018, 1:46pm UTC](https://discuss.elastic.co/t/filter-active-directory-event/130796/7 "2018-05-07T13:46:30Z")
I recommend you use the `event_id` filtering, as it is more efficient than a drop\_event processor. There were still some errors in your configuration. It worked for me with this: ```auto winlogbeat.event_logs: - name: Application ignore_older: 24h event_id: '5038,5039,4668' - name: Security ignore_older: 24h event_id: '4634,4624-4625,4608-4609,4700-4800,4611,4616,4618,4621,4627,4646-4649,4657,4662-4664,4670,4672-4674,4819,4825,4864-4902,4908,4913,4928-4937,4946-4960,4964' - name: System ignore_older: 24h event_id: '4648,4657,4760,4688-4689,4697-4699' ``` ---
**Author:** ![Hanen](https://avatars.discourse-cdn.com/v4/letter/h/5f8ce5/32.png) [@Hanen](https://discuss.elastic.co/u/Hanen)\ **Post date:** [May 10, 2018, 9:56am UTC](https://discuss.elastic.co/t/filter-active-directory-event/130796/8 "2018-05-10T09:56:03Z")
> [@adrisr](#): > > It worked for me Hello, thank you so much, it worked for me 😉😉 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 7, 2018, 9:56am UTC](https://discuss.elastic.co/t/filter-active-directory-event/130796/9 "2018-06-07T09:56:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.