Hello, I need assistance on getting a combined processor up and running.
Situation: I'm running metricbeat 7.9.1. I would like to set up the metricbeat to monitor windows services when:
windows.service.display_namestart with 'XYZ' AND
I have tried many notations among which below but I can't get the filtering implemented:
- drop_event: when: and: not.regex: - windows.service.display_name: "^XYZ.*" not.equals: - windows.service.start_type: "Automatic"`
How do I achieve this?