Hello, I need assistance on getting a combined processor up and running.
Situation: I'm running metricbeat 7.9.1. I would like to set up the metricbeat to monitor windows services when:
-
windows.service.display_name
start with 'XYZ' AND -
windows.service.start_type
is Automatic
I have tried many notations among which below but I can't get the filtering implemented:
`processors:
- drop_event:
when:
and:
not.regex:
- windows.service.display_name: "^XYZ.*"
not.equals:
- windows.service.start_type: "Automatic"`
How do I achieve this?