# Filter section in logstash
**URL:** https://discuss.elastic.co/t/filter-section-in-logstash/148273
**Category:** Logstash
**Created:** [September 12, 2018, 7:53am UTC](https://discuss.elastic.co/t/filter-section-in-logstash/148273 "2018-09-12T07:53:43Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@artem33region](https://discuss.elastic.co/u/artem33region)
#### Post date: [September 12, 2018, 7:53am UTC](https://discuss.elastic.co/t/filter-section-in-logstash/148273/1 "2018-09-12T07:53:43Z")
Hello!
I have logstash 6.2.4 and Winlogbeat 6.4.0
**Logstash config:**
input {
beats {
port =\> 5044
}
}
```
filter {
if [event_data.LogonType] == 3 {
mutate {
replace => ["event_data.LogonType", "interactive logon"]
}
}
}
output {
elasticsearch {
hosts => "IP_address:9200"
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
}
}
```
**Winlogbeat config:**
winlogbeat.event\_logs:
- name: Security
event\_id: 4624, 4625, 4647, 4659, 4660, 4663, 4670, 4720, 4728, 4732, 4740, 4756, 4768, 4738, 4771, 4776, 4778, 4779, 5136, 5137, 5139, 5141
ignore\_older: 72h
processors:
- drop\_fields:
fields: ["event\_data.OpCorrelationID", "event\_data.OldSd", "event\_data.ObjectGUID", "event\_data.ObjectDN", "event\_data.ObjectClass", "event\_data.NewSd", "event\_data.DSType", "event\_data.DSName", "event\_data.AttributeValue", "event\_data.DSName", "event\_data.AttributeValue", "event\_data.AttributeSyntaxOID", "event\_data.AttributeLDAPDisplayName", "event\_data.AppCorrelationID", "event\_data.Status", "event\_data.TicketEncryptionType", "event\_data.TicketOptions", "event\_data.ObjectServer", "event\_data.OperationType", "event\_data.PreAuthType", "event\_data.ServiceName", "event\_data.ServiceSid", "event\_data.Status", "event\_data.TicketEncryptionType", "event\_data.TicketOptions", "event\_data.HandleId", "event\_data.ServiceSid", "event\_data.TargetDomainName", "beat.hostname", "version", "\_id", "event\_data.TargetSid", "\_index", "\_score", "\_type", "activity\_id", "event\_data.AccessList", "event\_data.AccessMask", "event\_data.AdditionalInfo", "event\_data.ObjectType", "event\_data.ObjectName", "event\_data.Properties", "beat.name", "beat.version", "event\_data.AuthenticationPackageName", "event\_data.ElevatedToken", "event\_data.ImpersonationLevel", "event\_data.IpPort", "event\_data.KeyLength", "event\_data.LmPackageName", "event\_data.LogonGuid", "event\_data.LogonProcessName", "event\_data.ProcessId", "event\_data.ProcessName", "event\_data.RestrictedAdminMode", "event\_data.SubjectDomainName", "event\_data.SubjectLogonId", "event\_data.SubjectUserName", "event\_data.SubjectUserSid", "event\_data.TargetLinkedLogonId", "event\_data.TargetLogonId", "event\_data.TargetOutboundDomainName", "event\_data.TargetOutboundUserName", "event\_data.TargetUserSid", "event\_data.TransmittedServices", "event\_data.VirtualAccount", "event\_data.WorkstationName", "message", "opcode", "process\_id", "provider\_guid", "record\_number", "source\_name", "thread\_id", "type"]
- drop\_event:
when:
contains:
event\_data.TargetUserName: "$"
I want to replace value in field.
For example:
field "event\_data.LogonType" with value "3" i want to replace on "logon system"
How I able to do it?
Thanks!
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 12, 2018, 8:55am UTC](https://discuss.elastic.co/t/filter-section-in-logstash/148273/2 "2018-09-12T08:55:03Z")
Have a look at the translate filter. Also note Logstash's syntax for nested fields: [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references)
---
### Author:  [@artem33region](https://discuss.elastic.co/u/artem33region)
#### Post date: [September 12, 2018, 10:32am UTC](https://discuss.elastic.co/t/filter-section-in-logstash/148273/3 "2018-09-12T10:32:11Z")
Before i can use translate filter i need to install it?
logstash-plugin install logstash-filter-translate
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 10, 2018, 10:32am UTC](https://discuss.elastic.co/t/filter-section-in-logstash/148273/4 "2018-10-10T10:32:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.