# Filter not "fireing" being bypassed

**URL:** <https://discuss.elastic.co/t/filter-not-fireing-being-bypassed/124781>\
**Category:** Logstash\
**Created:** [March 20, 2018, 1:57pm UTC](https://discuss.elastic.co/t/filter-not-fireing-being-bypassed/124781 "2018-03-20T13:57:07Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ssi](https://avatars.discourse-cdn.com/v4/letter/s/a3d4f5/32.png) [@ssi](https://discuss.elastic.co/u/ssi)\
**Post date:** [March 20, 2018, 1:57pm UTC](https://discuss.elastic.co/t/filter-not-fireing-being-bypassed/124781/1 "2018-03-20T13:57:08Z")

</div>

windows environment beats input from windows event forwarder server. data is comming in not problem but the filter seems to be circumvented. the config was written for linux ubuntu,

input {  
beats {  
port =\> 5044  
add\_field =\> { "[@metadata][source]" =\> "beats"}  
type =\> "winlogbeat"

}  
}

filter {  
if [type] == "winlogbeat"{  
if [event\_id] == 4103 {  
mutate {  
add\_field =\> ["PayloadInvocation", "%{[event\_data][Payload]}" ]  
add\_field =\> ["PayloadParams", "%{[event\_data][Payload]}" ]  
gsub =\> [  
"[event\_data][ContextInfo]", " ", "",  
"[event\_data][ContextInfo]", " = ", "="  
]  
}  
mutate {  
gsub =\> [  
"PayloadInvocation", "CommandInvocation(._)", "commandinvocation",  
"PayloadInvocation", "ParameterBinding._\r\n", "",  
"PayloadParams", "parameterbinding(._)", "parameterbinding",  
"PayloadParams", "CommandInvocation._\r\n", "",  
"[event\_data][Payload]", "CommandInvocation._\r\n", "",  
"[event\_data][Payload]", "ParameterBinding._\r\n", ""  
]  
rename =\> { "[event\_load][Payload]" =\> "[powershell][payload]" }  
}  
kv {  
source =\> "PayloadInvocation"  
field\_split =\> "\n"  
value\_split =\> ":"  
allow\_duplicate\_values =\> false  
target =\> "[powershell]"  
include\_keys =\> ["commandinvocation"]  
}  
kv {  
source =\> "PayloadParams"  
value\_split =\> "="  
allow\_duplicate\_values =\> false  
target =\> "[powershell][param]"  
include\_keys =\> ["name", "value"]  
}  
kv {  
source =\> "[event\_data][ContextInfo]"  
field\_split =\> "\r\n"  
value\_split =\> "="  
remove\_char\_key =\> " "  
allow\_duplicate\_values =\> false  
include\_keys =\> ["Severity", "HostName", "HostVersion", "HostID", "HostApplication", "EngineVersion", "RunspaceID", "PipelineID", "CommandName", "CommandType", "ScriptName", "CommandPath", "SequenceNumber", "ConnectedUser", "ShellID"]  
}  
mutate {  
rename =\> {  
"CommandName" =\> "[powershell][command][name]"  
"CommandPath" =\> "[powershell][command][path]"  
"CommandType" =\> "[powershell][command][type]"  
"ConnectedUser" =\> "[powershell][connected][user]"  
"EngineVersion" =\> "[powershell][engine][version]"  
"HostApplication" =\> "[powershell][host][application]"  
"HostID" =\> "[powershell][host][id]"  
"HostName" =\> "[powershell][host][name]"  
"HostVersion" =\> "[powershell][host][version]"  
"PipelineID" =\> "[powershell][pipeline][id]"  
"RunspaceID" =\> "[powershell][runspace][id]"  
"Scriptname" =\> "[powershell][script][name]"  
"SequenceNumber" =\> "[powershell][sequence][number]"  
"ShellID" =\> "[powershell][shell][id]"  
}  
remove\_field =\> [  
"Severity",  
"EventType",  
"Keywords",  
"message",  
"Opcode",  
"PayloadInvocation",  
"PayloadParams",  
"[event\_data][Payload]",  
"[event\_data][ContextInfo]"  
]  
convert =\> { "[powershell][pipeline][id]" =\> "integer" }  
convert =\> { "[powershell][sequence][number]" =\> "integer" }  
}  
}  
if [event\_id] == 4104 {  
mutate {  
rename =\> {  
"[event\_data][MessageNumber]" =\> "[powershell][message][number]"  
"[event\_data][MessageTotal]" =\> "[powershell][message][total]"  
"[event\_data][ScriptBlockId]" =\> "[powershell][scriptblock][id]"  
"[event\_data][ScriptBlockText]" =\> "[powershell][scriptblock][text]"  
"[event\_data][Path]" =\> "[powershell][script][path]"  
}  
remove\_field =\> ["message"]  
convert =\> { "[powershell][message][number]" =\> "integer" }  
convert =\> { "[powershell][message][total]" =\> "integer" }  
convert =\> { "[powershell][scriptblock][id]" =\> "integer" }  
}  
}  
if [event\_id] == 400 or [event\_id] == 600 {  
kv {  
source =\> "[event\_data][param3]"  
field\_split =\> "\n"  
value\_split =\> "="  
trim\_key =\> "\t"  
allow\_duplicate\_values =\> false  
}  
mutate {  
rename =\> {  
"ProviderName" =\> "[powershell][providername]"  
"NewProviderState" =\> "[powershell][newproviderstate]"  
"SequenceNumber" =\> "[powershell][sequencenumber"  
"HostName" =\> "[powershell][host][name]"  
"HostVersion" =\> "[powershell][host][version]"  
"HostId" =\> "[powershell][host][id]"  
"HostApplication" =\> "[powershell][host][application]"  
"EngineVersion" =\> "[powershell][engine][version]"  
"RunspaceId" =\> "[powershell][runspace][id]"  
"PipelineId" =\> "[powershell][pipeline][id]"  
"CommandName" =\> "[powershell][command][name]"  
"CommandType" =\> "[powershell][command][type]"  
"ScriptName" =\> "[powershell][script][name]"  
"CommandPath" =\> "[powershell][command][path]"  
"CommandLine" =\> "[powershell][command][line]"  
"NewEngineState" =\> "[powershell][newengine][state]"  
"PreviousEngineState" =\> "[powershell][previousengine][state]"  
}  
remove\_field =\> ["message"]  
remove\_field =\> "[event\_data][param1]"  
remove\_field =\> "[event\_data][param2]"  
remove\_field =\> "[event\_data][param3]"  
}  
}  
}  
}

output {  
if [log\_name] == "Microsoft-Windows-Sysmon/Operational"{  
elasticsearch {  
hosts =\> ["127.0.0.1:9200"]  
index =\> "logs-endpoint-winevent-sysmon-%{+YYYY.MM.dd}"  
template =\> "/ELK/6.0.0/logstash/logstash-6.0.0/output\_templates/winevent-sysmon- template.json"  
template\_name =\> "logs-endpoint-winevent-sysmon"  
template\_overwrite =\> true  
document\_id =\> "%{[@metadata][log\_hash]}"  
user =\> "XXXXXXXXXXX"  
password =\> "XXXXXXXXX"  
}  
}  
}

in kibana

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 17, 2018, 1:57pm UTC](https://discuss.elastic.co/t/filter-not-fireing-being-bypassed/124781/2 "2018-04-17T13:57:42Z")

</div>

Closed on April 17, 2018, 1:57pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.