Logstash eventlog filter

Elastic Stack Logstash
23

Hi,

I tried your configuration with the only difference that I used winlogbeat instead of nxlog (and different field names: level instead of Severity) and it works ok.

I am not sure what is the issue there.

As a diferent solution you can try drop filter. I am using this to remove very noisy events. As an example in you case it will be something like this:

#####Match type and level.
filter {
  # Drop informational events
  if [type] == "eventlog" and [Severity] == "WARNING" {
    drop { }
  }
# Drop warning events
  if [type] == "eventlog" and [Severity] == "INFO" {
    drop { }
  }
}

*(Before you use this -if you do- check and make sure that the field names and values correspond to yours)