# Filter system logons

**URL:** https://discuss.elastic.co/t/filter-system-logons/225001
**Category:** Beats
**Tags:** winlogbeat
**Created:** [March 25, 2020, 2:23pm UTC](https://discuss.elastic.co/t/filter-system-logons/225001 "2020-03-25T14:23:42Z")
**Posts on this page:** 1
**Showing post:** 10

<div class="post-metadata">

### Author: ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)
#### Post date: [April 15, 2020, 9:15am UTC](https://discuss.elastic.co/t/filter-system-logons/225001/10 "2020-04-15T09:15:13Z")

</div>

Umm, this event should have been skipped with this config:

```auto
winlogbeat.event_logs:
- name: Security
  processors:
  - drop_event:
      when:
        and:
          - or:
            - equals.winlog.event_id: 4624
            - equals.winlog.event_id: 4634
          - or:
            - equals.winlog.event_data.TargetUserName: "SYSTEM"
            - equals.winlog.event_data.TargetUserName: "NAMESQL"

```

To add more rules to match names you don't need to remove these ones, you can for example add your regexp, and keep the rule for the `SYSTEM` user:

```auto
winlogbeat.event_logs:
- name: Security
  processors:
  - drop_event:
      when:
        and:
          - or:
            - equals.winlog.event_id: 4624
            - equals.winlog.event_id: 4634
          - or:
            - equals.winlog.event_data.TargetUserName: 'SYSTEM'
            - regexp.winlog.event_data.TargetUserName: '^SQL.*\$'

```

---

_[View the full topic](https://discuss.elastic.co/t/filter-system-logons/225001)._