Logstash Filter to drop Beats events

Elastic Stack Logstash
1

I tried hard to filter most events i'm not interested in in the Winlogbeat config. However, I've now got ~100 Windows servers and I don't want to edit 100 files to filter events 256 / 258. I'm trying to use Logstash to do it.

In the Filter section of the logstash.conf in conf.d I have :

filter {
if [event_id] == 256 {
drop { }
}
if [event_id] == 258 {
drop { }
}
}

There is a # in Kibana for event_id. So I'm assuming it's an Integer. But I've tried it with quotes "256". Without quotes. I've tried it without the brackets [event_id]. I've tried it With quotes around the "Event_Id" field. I'm simply at a loss. Logstash does not drop the event. Any recommendations of things I could try would be greatly appreciated.

2

I appear to have solved this. I needed :

[winlog][event_id] == 256

The double square brackets for nested fields was in the documentation. There's other documentation, I was looking at the wrong documentation. Ha ha.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.