# How Filtering logstash output from winlogbeat using winevent More detail?

**URL:** <https://discuss.elastic.co/t/how-filtering-logstash-output-from-winlogbeat-using-winevent-more-detail/224338>\
**Category:** Logstash\
**Created:** [March 20, 2020, 2:18am UTC](https://discuss.elastic.co/t/how-filtering-logstash-output-from-winlogbeat-using-winevent-more-detail/224338 "2020-03-20T02:18:23Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![dhimasjoe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dhimasjoe/32/46835_2.png) [@dhimasjoe](https://discuss.elastic.co/u/dhimasjoe)\
**Post date:** [March 20, 2020, 2:18am UTC](https://discuss.elastic.co/t/how-filtering-logstash-output-from-winlogbeat-using-winevent-more-detail/224338/1 "2020-03-20T02:18:23Z")

</div>

#Windwos event ID

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/b/fbc167fce7e9f394812702c08445a10a71360ad3.png)

#I have filtering using EventID and work 100% , but how to more specific filtering , i want to dinied QueryName below :

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/4/e40b5b497bdc7304b01fb22b70cb4c1d71a23b98.png)

my config :

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/6/66a33ad3d788a2ea942fee7f20ec02d606c7ea45.png)

thanks.

---

<div class="post-metadata">

**Author:** ![Crispin124](https://avatars.discourse-cdn.com/v4/letter/c/c68b51/32.png) [@Crispin124](https://discuss.elastic.co/u/Crispin124)\
**Post date:** [March 20, 2020, 4:47am UTC](https://discuss.elastic.co/t/how-filtering-logstash-output-from-winlogbeat-using-winevent-more-detail/224338/2 "2020-03-20T04:47:32Z")

</div>

To understanding.

---

<div class="post-metadata">

**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\
**Post date:** [March 20, 2020, 7:03am UTC](https://discuss.elastic.co/t/how-filtering-logstash-output-from-winlogbeat-using-winevent-more-detail/224338/3 "2020-03-20T07:03:47Z")

</div>

Hi there,

I'm afraid I don't really get what you would like to do. Can you please be a bit more specific?

Also, can you post here a sample of what logstash spits out setting as output of your pipeline `stadout{}` and pasting here ( **properly indented and formatted** ) what it returns?

Thanks

---

<div class="post-metadata">

**Author:** ![dhimasjoe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dhimasjoe/32/46835_2.png) [@dhimasjoe](https://discuss.elastic.co/u/dhimasjoe)\
**Post date:** [March 20, 2020, 8:07am UTC](https://discuss.elastic.co/t/how-filtering-logstash-output-from-winlogbeat-using-winevent-more-detail/224338/4 "2020-03-20T08:07:43Z")

</div>

#my output from logstash

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/2/42e7bbaa275a75c5f4f35d0d46b5e8e35b2cc5a1.png)

# and the result from logstash

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/3/3333d64447c3db5eada20c6d88f0fa21b782d557.png)  
#my question how to denied the result web site  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/e/5e88b9c7577ad1130f8c7fdd6cd0dc339e84f603.png)

- becouse windows always automatic go to that URL

---

<div class="post-metadata">

**Author:** ![dhimasjoe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dhimasjoe/32/46835_2.png) [@dhimasjoe](https://discuss.elastic.co/u/dhimasjoe)\
**Post date:** [March 20, 2020, 8:10am UTC](https://discuss.elastic.co/t/how-filtering-logstash-output-from-winlogbeat-using-winevent-more-detail/224338/5 "2020-03-20T08:10:14Z")

</div>

#I Want to monitoring in client who access the browser , so i use windows event "Microsoft-Windows-DNS-Client" to get the log .

#but how to filter like my fist qwestion

thanks for helping ,

---

<div class="post-metadata">

**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\
**Post date:** [March 20, 2020, 8:30am UTC](https://discuss.elastic.co/t/how-filtering-logstash-output-from-winlogbeat-using-winevent-more-detail/224338/6 "2020-03-20T08:30:55Z")

</div>

I meant what it returns not what you wrote in your output section. Next to that elasticsearch output, put the line `stdout{}` so the same logs that are sent to ES are also written on the console, the exact way Logstash sees them. You should put in your output section of your conf file something like:

```
output {
  if [log_name] == "Microsoft-Windows-DNS-Client/Operational" and [@metadata][helk_parsed] == "yes" {
    elasticsearch {
      hosts => ["localhost:9200"]
      index => "logs-endpoint-winevent-dns-client-%{+YYYY.MM.dd}"
      document_id => "%{[@metadata][log_hash]}"
      #user => 'elastic'
      #password => 'elasticpassword'
    }

    stdout {}
  }
}

```

Anyway, if I got it right you want to exclude all those logs that have "[win8.ipv6.microsoft.com](http://win8.ipv6.microsoft.com)." in the `url_access` field, right? Or do you want to exclude any log that even has that field, no matter the value inside it?

Finally, please in your next posts do not put screenshot of code because if you do so, other people have to rewrite everything you already wrote in order to replicate what you did. So take your piece of code, paste it here properly indented, you will see it not indented on the right (preview) event if it is indented on the left, like this:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/5/954322f5d03a5e14969229112e2882fb2c85dd53.png)

Then you simply highlight your piece of code and click on the **`Preformatted text`** tool ( ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/6/d6dd1b0c724f29d442c9fb5ba247bb6d924caf04.png) ) to make it like this:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/3/d35588bbbb56a7ac2db2d0eaf57b13f4efcf41e5.png)

Perfectly readable and ready to be copied and pasted.

---

<div class="post-metadata">

**Author:** ![Crispin124](https://avatars.discourse-cdn.com/v4/letter/c/c68b51/32.png) [@Crispin124](https://discuss.elastic.co/u/Crispin124)\
**Post date:** [March 21, 2020, 4:49am UTC](https://discuss.elastic.co/t/how-filtering-logstash-output-from-winlogbeat-using-winevent-more-detail/224338/7 "2020-03-21T04:49:32Z")

</div>

Thanks for this, let me try this one[.](https://www.talktosonic.website/)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 18, 2020, 4:49am UTC](https://discuss.elastic.co/t/how-filtering-logstash-output-from-winlogbeat-using-winevent-more-detail/224338/8 "2020-04-18T04:49:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.