Filtering by event id

Elastic Stack Beats
2

Are you sure that there is new data coming in that matches your filter? When you add filters like this Winlogbeat creates a query that it passes to Windows such that Windows only sends the matching events. For example, your Security log will use a query like:

<QueryList>
  <Query Id="0">
    <Select Path="Security">*[System[TimeCreated[timediff(@SystemTime) &lt;= 172800000] and (EventID &gt;= 500 and EventID &lt;= 820) and (Level = 1 or Level = 2 or Level = 3 or Level = 0 or Level = 4)]]</Select>
  </Query>
</QueryList>

If you enable debug logging for Winlogbeat it will write these XML queries to the log file. If you want to play with the query more, you can paste it into the Windows Event Viewer and see what it matches. https://blogs.technet.microsoft.com/askds/2011/09/26/advanced-xml-filtering-in-the-windows-event-viewer/