# Logstash Filter to drop Beats events

**URL:** <https://discuss.elastic.co/t/logstash-filter-to-drop-beats-events/196372>\
**Category:** Logstash\
**Created:** [August 22, 2019, 5:00pm UTC](https://discuss.elastic.co/t/logstash-filter-to-drop-beats-events/196372 "2019-08-22T17:00:40Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jwwags92](https://avatars.discourse-cdn.com/v4/letter/j/f6c823/32.png) [@jwwags92](https://discuss.elastic.co/u/jwwags92)\
**Post date:** [August 22, 2019, 5:00pm UTC](https://discuss.elastic.co/t/logstash-filter-to-drop-beats-events/196372/1 "2019-08-22T17:00:41Z")

</div>

I tried hard to filter most events i'm not interested in in the Winlogbeat config. However, I've now got ~100 Windows servers and I don't want to edit 100 files to filter events 256 / 258. I'm trying to use Logstash to do it.

In the Filter section of the logstash.conf in conf.d I have :

filter {  
if [event\_id] == 256 {  
drop { }  
}  
if [event\_id] == 258 {  
drop { }  
}  
}

There is a # in Kibana for event\_id. So I'm assuming it's an Integer. But I've tried it with quotes "256". Without quotes. I've tried it without the brackets [event\_id]. I've tried it With quotes around the "Event\_Id" field. I'm simply at a loss. Logstash does not drop the event. Any recommendations of things I could try would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![jwwags92](https://avatars.discourse-cdn.com/v4/letter/j/f6c823/32.png) [@jwwags92](https://discuss.elastic.co/u/jwwags92)\
**Post date:** [August 22, 2019, 5:46pm UTC](https://discuss.elastic.co/t/logstash-filter-to-drop-beats-events/196372/2 "2019-08-22T17:46:25Z")

</div>

I appear to have solved this. I needed :

[winlog][event\_id] == 256

The double square brackets for nested fields was in the documentation. There's other documentation, I was looking at the wrong documentation. Ha ha.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 19, 2019, 5:46pm UTC](https://discuss.elastic.co/t/logstash-filter-to-drop-beats-events/196372/3 "2019-09-19T17:46:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.