I need to be able to build a drop rule when a filed is missing from the event, I'm not currently able to filter and do not see any conditions that would help with this. Example:
processors: - drop_event.when: and: - equals.event_id: 800 - or: ## Common - equals.event_data.param1: " Microsoft.PowerShell.Core\\Set-StrictMode -Off" ## no command / param1 missing - equals.event_data.param1: ""
I know this can be dropped at Logstash, but I don't even want to send events to Logstash if "param1" is not present in the 800 events.
Can anyone help with some winlogbeat filtering config that could accomplish this task? I think i can do this with a not matches regex with ".*" but this seems like it would be a performance hit.