# Filter out Windows proccesses

**URL:** <https://discuss.elastic.co/t/filter-out-windows-proccesses/180392>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [May 9, 2019, 3:04pm UTC](https://discuss.elastic.co/t/filter-out-windows-proccesses/180392 "2019-05-09T15:04:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Thomas\_Kucirek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomas_kucirek/32/45910_2.png) [@Thomas\_Kucirek](https://discuss.elastic.co/u/Thomas_Kucirek)\
**Post date:** [May 9, 2019, 3:04pm UTC](https://discuss.elastic.co/t/filter-out-windows-proccesses/180392/1 "2019-05-09T15:04:45Z")

</div>

Hi, i want to filter the events collected by the winlogbeat. Because it is a lot of unwanted noise, i want to drop all events that come from the System32 processes like svchost, backGroundTaskhost etc.

I've tried using drop\_event in different ways but it does not seem to work since it is still included in the output.  
I tried several ways based on examples i found but none of them seem to do anything:

```auto
 - drop_event:
    when.or:
      - regexp.event_data.NewProcessName: 'C:\\Windows\\System32\\*'

  - drop_event:
     when:
       equals.event_data.ParentProcessName: ['C:\\Windows\\System32\\svchost.exe']

  - drop_event:
     when:
        contains:
           event_data.NewProcessName: ["C:\\Windows\\System32*"] 

```

Any help for this is very much appreciated and i hope the formatting was ok.  
Thanks

---

<div class="post-metadata">

**Author:** ![Thomas\_Kucirek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomas_kucirek/32/45910_2.png) [@Thomas\_Kucirek](https://discuss.elastic.co/u/Thomas_Kucirek)\
**Post date:** [May 9, 2019, 4:24pm UTC](https://discuss.elastic.co/t/filter-out-windows-proccesses/180392/2 "2019-05-09T16:24:53Z")

</div>

Ok I managed to work around it by filtering the message of the event for the System32 directory and drop the event if it is contained:

```auto
  - drop_event.when:
       contains.message: "C:\\Windows\\System32\\"

```

But later on i would like to drop the field message if possible so any further directions would be helpful.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 6, 2019, 4:25pm UTC](https://discuss.elastic.co/t/filter-out-windows-proccesses/180392/3 "2019-06-06T16:25:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.