# Logstash Filter for Specific Winlogs Value

**URL:** <https://discuss.elastic.co/t/logstash-filter-for-specific-winlogs-value/204962>\
**Category:** Logstash\
**Created:** [October 23, 2019, 8:55pm UTC](https://discuss.elastic.co/t/logstash-filter-for-specific-winlogs-value/204962 "2019-10-23T20:55:38Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![uklipse](https://avatars.discourse-cdn.com/v4/letter/u/cdc98d/32.png) [@uklipse](https://discuss.elastic.co/u/uklipse)\
**Post date:** [October 23, 2019, 8:55pm UTC](https://discuss.elastic.co/t/logstash-filter-for-specific-winlogs-value/204962/1 "2019-10-23T20:55:38Z")

</div>

I'm trying to filter out some specific values for the Windows event id 4663. We have one computer that generates 99% of these events and we want to filter that out. Below is what I have but it's not working. The add\_tag is to let me know that it's working correctly before I change it to drop the logs.

I'm having troubles at the [event\_data][SubjectUserName] line. The tag isn't added here but if I remove this line it adds the tag for all 4663 events but I want filter based on the SubjectUserName. Any ideas what I'm missing?

```
filter {
  if "winlogbeat" in [tags] {
    if [EventID] == 4663 {
      if [event_data][SubjectUserName] == "NoisyHost$" {
        mutate {
          add_tag => ["4663_dropped"]
          }
      }
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![Andre\_Letterer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andre_letterer/32/42248_2.png) [@Andre\_Letterer](https://discuss.elastic.co/u/Andre_Letterer)\
**Post date:** [October 24, 2019, 2:30am UTC](https://discuss.elastic.co/t/logstash-filter-for-specific-winlogs-value/204962/2 "2019-10-24T02:30:31Z")

</div>

Without an example document it is difficult, but it looks like it is a winlogbeat document.  
Possibly you can chance `4663` to `"4663"` or escape the hostname by `"NoisyHost\$"`.  
What is possibly as well is, that the path to the EventID or SubjectUsername is wrong.  
Maybe you can provide an anonymized example document?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 24, 2019, 2:23pm UTC](https://discuss.elastic.co/t/logstash-filter-for-specific-winlogs-value/204962/3 "2019-10-24T14:23:14Z")

</div>

> [@uklipse](#):
>
> if [event\_data][SubjectUserName] == "NoisyHost$" {

That is a string comparison that matches a string that ends with a dollar sign. If you meant it to match any name that ends with NoisyHost you would have to replace == with =~

---

<div class="post-metadata">

**Author:** ![uklipse](https://avatars.discourse-cdn.com/v4/letter/u/cdc98d/32.png) [@uklipse](https://discuss.elastic.co/u/uklipse)\
**Post date:** [October 24, 2019, 3:21pm UTC](https://discuss.elastic.co/t/logstash-filter-for-specific-winlogs-value/204962/4 "2019-10-24T15:21:34Z")

</div>

I'm trying to match a computer account name which has a dollar sign at the end. I could probably get by with just matching the hostname without the dollar sign but I'm not sure how to do a partial match.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 21, 2019, 3:21pm UTC](https://discuss.elastic.co/t/logstash-filter-for-specific-winlogs-value/204962/5 "2019-11-21T15:21:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.