How can I skip recording an event with these conditions

[jftuga]

I am using winlogbeat. How can I exclude events that meet the following criteria:

• event_id = 4670
• only when the "related": "user" value ends with a $
• (alternatively) the "user": "name" ends with a $

Values that end in a $ correspond to machine accounts and I am not interested logging these.

Thanks,
-John

[Jason_Slater]

Hi John,

You can add filtering in your winlogbeat.yml file -- see winlogbeat.reference.yml for examples

See this page for documentation on conditions:

Define processors | Filebeat Reference [7.12] | Elastic

Specifically, you would need to add something like this to your winlogbeat.yml file:

  processors:
      - drop_event:
          when:
            and:
              - equals:
                  event_id: 4670
              - or
                  - regexp:
                      related.user: "\\$$"
                  - regexp:
                      user.name: "\\$$"