Filter *.tmp

(Arlen Gomes) #1


I am sending the logs from my file server with winlogbeat.

I just send the log with event 4663, to track file deletion, however, the Kibana view shows several temporary file events (* .tmp). Is it possible to do this filter in the Logstash input or some display filter in Kibana?

(Magnus Bäck) #2

You can probably do it either way, but the exact implementation depends on what an example event looks like. Copy an example event from Kibana's JSON tab.

(Arlen Gomes) #3

Sorry for the delay Magnus ....

Follow the print.

(Magnus Bäck) #4

Please don't post screenshots when regular copy/paste of the text works just as well (or better). It's also easier to obfuscate private data that way.

Okay, good, the filename is already in a discrete field. Just use a drop filter wrapped in a conditional that inspects the contents of the [event_data][ObjectName] field. See and the many examples that have been posted in the past.

(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.