KQL filter if more values

[probson (Philip Robson)]

Hi,

Looking to query a field such as process.args:"atbroker.exe"
but would only want a hit if there is more in process.args than just atbroker.exe

Is this possible?

Thanks
Phil

[aaron-nimocks]

What type data is this?

Try process.args: *atbroker.exe* to see if it works. But it depends on your data mapping and structure.

[wylie (Wylie Conlon)]

Assuming that process.args is an array of strings, then KQL cannot support this query. You can write this using the script query with painless. Something like this would be your script:

doc['args'].size() > 0 && (
  !doc['args'].contains('/path/to/executable') ||
  (
    doc['args'].size() > 1 && doc['args'].contains('/path/to/executable')
  )
)

You can use this as an AND in the query DSL from Kibana.

[probson (Philip Robson)]

Hi,

Thanks for the help, it sparked an idea which lead to the below.

I have gotten around the issue by using ruby in logstash to count the arrays, i noticed that since ECS 1.3 process.args_count looks to be for what i need, as of winlogbeat 7.9.2 it is not implemented yet.

"event.set('[process][args_count]', event.get('[process][args]').length)"

Thanks
Phil