Is there a way to filter events in winlogbeat so I am only sending certain event id's? I am specifically looking to send only event id 8003 for now to limit the transmission of data to our ELK stack. I have around 20,000 machines that could send data. Thanks!

Filtering Winlogbeat on Event ID

Topic		Replies	Views
Winlogbeat "event_id" filter does not seem to be working Beats winlogbeat	2	883	September 16, 2019
Help with basic filtering of eventID from winlogbeat Logstash	3	396	May 5, 2020
Winlogbeat doesn't drop events Beats winlogbeat	5	656	June 7, 2023
Logstash Filter to drop Beats events Logstash	2	279	September 19, 2019
Filtering not working Beats winlogbeat	8	767	July 9, 2020

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Filtering Winlogbeat on Event ID

Related topics