Help with basic filtering of eventID from winlogbeat

[sbagciva (Serhatb)]

so Im trying to filter out a event code in my logstash conf file..

so I have the basic conf..

input {
beats {
port => ....
type => "log"
}
}

to filter I put this
filter {
if [type] == "wineventlog" and [event_id] == 33205 {
drop { }
}
}

... this filter doesnt work and gives me errors?

[Badger]

@sbagciva

gives me errors?

What are the errors?

[sbagciva (Serhatb)]

i figured out my error from another post in the forum. thank you. im suppose to do

if [winlog][event_id] = 33205 {
drop { }
}