# Nested and/or statements
**URL:** https://discuss.elastic.co/t/nested-and-or-statements/283223
**Category:** Beats
**Tags:** winlogbeat
**Created:** [September 2, 2021, 11:00pm UTC](https://discuss.elastic.co/t/nested-and-or-statements/283223 "2021-09-02T23:00:50Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@d-ring](https://discuss.elastic.co/u/d-ring)
#### Post date: [September 2, 2021, 11:00pm UTC](https://discuss.elastic.co/t/nested-and-or-statements/283223/1 "2021-09-02T23:00:50Z")
I am working on using some nested and/or statements in my winlogbeat to filter out some noisy logs and I am running into an issue where things are not being dropped as expected. I am curious what I have wrong in this section of the configuration where event id 22 is not being dropped.
Looking at a blog here [Winlogbeat and pipelines and painless scripts, oh my! – Rambling Cookie Monster](http://ramblingcookiemonster.github.io/winlogbeat-pipeline/) he is using equals.event\_id: for the filtering and in this one [Ship Windows event logs with Winlogbeat](https://hochwald.net/ship-windows-event-logs-with-winlogbeat/) he is using equals.winlog.event\_id: to filter out specific event Ids and/or events.
As an example here is one for sysmon where I want to drop all event id 22 events and event id 1 with specific processes.
Am I using the wrong form of event id or is my yml or logic off? How I know this is not working is I still see event 22 in elasticsearch.
```auto
- name: Microsoft-Windows-Sysmon/Operational
ignore_older: 72h
processors:
- drop_event.when:
or:
- equals.event_id: '22'
- and:
- equals.event_id: '1'
- or:
- equals.process.commandline: 'C:\WINDOWS\system32\svchost.exe -k appmodel -p -s camsvc'
- equals.process.commandline: 'C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation -s SCardSvr'
- equals.process.commandline: 'C:\WINDOWS\System32\svchost.exe -k secsvcs'
- equals.process.commandline: 'C:\WINDOWS\system32\svchost.exe -k GPSvcGroup'
- equals.process.commandline: 'C:\WINDOWS\System32\svchost.exe -k wsappx -p -s ClipSVC'
- equals.process.commandline: 'C:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc'
- equals.process.commandline: 'C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s NgcSvc'
- equals.process.commandline: 'C:\Windows\system32\svchost.exe -k localService -s RemoteRegistry'
- equals.process.commandline: 'C:\windows\system32\svchost.exe -k netsvcs -s BITS'
- equals.process.commandline: 'C:\windows\system32\svchost.exe -k netsvcs -p -s NetSetupSvc'
- equals.process.commandline: 'C:\windows\system32\svchost.exe -k netsvcs -p -s wisvc'
- equals.process.commandline: 'C:\windows\system32\svchost.exe -k netsvcs -p -s dmwappushservice'
- equals.process.commandline: 'C:\windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s SmsRouter'
- equals.process.commandline: 'C:\windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts'
- equals.process.executable: 'C:\Windows\CCM\UpdateTrustedSites.exe'
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 1, 2021, 1:01am UTC](https://discuss.elastic.co/t/nested-and-or-statements/283223/2 "2021-10-01T01:01:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.