Hello,
I have following logstash configuration file for winlogbeat events:
input {
#Winlgobeat
beats {
port => 5044
}
}
filter {
#Filter winlogbeat events
mutate {
rename => {
"[event][code]" => "event_id"
"[winlog][event_data][TargetUserName]" => "destination_user_name"
"[winlog][event_data][MemberName]" => "tls_client_issuer"
}
}
if [source_ip] == "-" {
mutate {
replace => [ "source_ip", "0.0.0.0" ]
}
}
mutate {
copy => { "[message]" => "event_original" }
}
if [event_id] == "4755" or [event_id] == "4731" or [event_id] == "4763" or [event_id] == "4730" or [event_id] == "4758" or [event_id] == "4754" or [event_id] == "4759" or [event_id] == "4760" or [event_id] == "4757" or [event_id] == "4735" or [event_id] == "4729" or [event_id] == "4732" or [event_id] == "4756" or [event_id] == "4737" or [event_id] == "4727" or [event_id] == "4728" or [event_id] == "4762" or [event_id] == "4761" {
mutate {
rename => {
"destination_user_name" => "group_name"
"tls_client_issuer" => "destination_user_name"
}
}
}
}
What I want to achieve is that when event_id match any of the OR condition defined, to rename the mentioned field names.
This configuration seems to work fine, but after a few hours it stopped working as some of the events were not renamed according to the condition defined. After a few minutes, it start working again, when no changes/restart of service are applied.
Could you help me with this issue?
Thank you.