Logstash filter on number

Elastic Stack Logstash
1

Trying to filter on an number, in this case 4624, in Logstash. But unable to get it to work. I was able to key off of event.kind, but that is a word and all events have that, so not an option. I have looked for days and unable to find anyone that has had the same issue, but no such luck. Thanks.

Example:

"event": {
    "code": 4624,
    "kind": "event",
    "created": "2020-03-13T08:06:30.606Z",
    "action": "Logon"

Filters I have tried.

if [event][code] == "4624" {
mutate {
  add_tag => [ "testing" ]
  }
}

if "4624" in [event][code] {
  mutate {
    add_tag => [ "testing" ]
  }
}

if [4624] in [event][code] {
    mutate { add_tag => [ "testing" ] }
     } 
    }
if [event][code] =~ "4624" {
mutate {
  add_tag => [ "testing" ]
  }

 if [event][code] =~ 4624 {
          mutate { add_tag => [ "testing" ] }
     }
  }
2

Have you tried comparing it to a number?

if [event][code] == 4624 {
3

Badger,

Apolgies, this is how we got it to work.

if [event][kind] == "event" and [event][code] == 4624 {

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.