# Filter winlogbeat

**URL:** https://discuss.elastic.co/t/filter-winlogbeat/201647
**Category:** Beats
**Tags:** winlogbeat
**Created:** [September 30, 2019, 1:19pm UTC](https://discuss.elastic.co/t/filter-winlogbeat/201647 "2019-09-30T13:19:34Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![DorianL](https://avatars.discourse-cdn.com/v4/letter/d/8e7dd6/32.png) [@DorianL](https://discuss.elastic.co/u/DorianL)
#### Post date: [September 30, 2019, 1:19pm UTC](https://discuss.elastic.co/t/filter-winlogbeat/201647/1 "2019-09-30T13:19:34Z")

</div>

Hello,

As part of the implementation of a centralized logging system in my company I am configuring winlogbeat to visualize my logs of login and logoff.  
I send the data directly to the elasticsearch cloud.  
But I am poled by internal connection of my cluster so I need to make filters.

Here is what I put in my winlogbeat.yml file:

```
processors:
  - drop_event.when.or: 
    - regexp.winlog.event_data.SubjectUserName: '.*\$'
    - regexp.winlog.event_data.TargetUserName: '.*\$'
    - regexp.winlog.event_data.TargetUserName: 'HealthMailbox*'
    - equals.winlog.event_data.TargetUserName: 'ANONYMOUS LOGON'
    - equals.winlog.event_data.LogonType: '0'
    - equals.winlog.event_data.LogonType: '5'

```

But the display in SIEM is no longer viable ...  
So I put this:

```
processors:
  - drop_event.when.or: 
    - regexp.winlog.event_data.SubjectUserName: '.*\$'
    - regexp.winlog.event_data.TargetUserName: '.*\$'
    - regexp.winlog.event_data.TargetUserName: 'HealthMailbox*'
    - equals.winlog.event_data.TargetUserName: 'ANONYMOUS LOGON'
    - equals.winlog.event_data.LogonType: '0'
    - equals.winlog.event_data.LogonType: '5'
processors:
  - script:
      lang: javascript
      id: security
      file: ${path.home}/module/security/config/winlogbeat-security.js

```

But now the filter does not work anymore ...  
Could you help me?

Thank you

---

<div class="post-metadata">

### Author: ![MarianaD](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marianad/32/42687_2.png) [@MarianaD](https://discuss.elastic.co/u/MarianaD)
#### Post date: [September 30, 2019, 1:40pm UTC](https://discuss.elastic.co/t/filter-winlogbeat/201647/2 "2019-09-30T13:40:56Z")

</div>

hi @DorianL, I see you are defining the `processors` 2 times in your config file. Can you add the script processor under the first `processors` tag and let us know if this worked in your case?

---

<div class="post-metadata">

### Author: ![DorianL](https://avatars.discourse-cdn.com/v4/letter/d/8e7dd6/32.png) [@DorianL](https://discuss.elastic.co/u/DorianL)
#### Post date: [September 30, 2019, 2:06pm UTC](https://discuss.elastic.co/t/filter-winlogbeat/201647/3 "2019-09-30T14:06:48Z")

</div>

After a weekend of tests, it finally works thanks to you, thank you very much 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 28, 2019, 2:06pm UTC](https://discuss.elastic.co/t/filter-winlogbeat/201647/4 "2019-10-28T14:06:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.