# Problems with AND in drop\_events.when.or

**URL:** <https://discuss.elastic.co/t/problems-with-and-in-drop-events-when-or/252066>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [October 14, 2020, 3:43pm UTC](https://discuss.elastic.co/t/problems-with-and-in-drop-events-when-or/252066 "2020-10-14T15:43:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Matthew\_Smith](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matthew_smith/32/77188_2.png) [@Matthew\_Smith](https://discuss.elastic.co/u/Matthew_Smith)\
**Post date:** [October 14, 2020, 3:43pm UTC](https://discuss.elastic.co/t/problems-with-and-in-drop-events-when-or/252066/1 "2020-10-14T15:43:48Z")

</div>

I'm trying to drop a particular event id (4624 or 4627) when the TargetUserName is SYSTEM and then also just always drop event id 5379. What am I doing wrong here?

```
# Needed for Graylog

fields_under_root: true

fields.collector_node_id: ${sidecar.nodeName}

fields.gl2_source_collector: ${sidecar.nodeId}

output.logstash:

  hosts: ["HOST"]

path:

  data: C:\Program Files\Graylog\sidecar\cache\winlogbeat\data

  logs: C:\Program Files\Graylog\sidecar\logs

tags:

- windows

winlogbeat:

event_logs:

  - name: Application

  - name: System

  - name: Security

processors:

- drop_event.when.or:

  - equals.event_id: 5379

  - and:

    - equals.winlogbeat_event_data_TargetUserName: SYSTEM

    - or:

      - equals.event_id: 4624

      - equals.event_id: 4627
```

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [October 14, 2020, 4:49pm UTC](https://discuss.elastic.co/t/problems-with-and-in-drop-events-when-or/252066/2 "2020-10-14T16:49:04Z")

</div>

> [@Matthew\_Smith](#):
>
> `winlogbeat_event_data_TargetUserName`

That field name looks wrong. It should be `winlog.event_data.TargetUserName`.

---

<div class="post-metadata">

**Author:** ![Matthew\_Smith](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matthew_smith/32/77188_2.png) [@Matthew\_Smith](https://discuss.elastic.co/u/Matthew_Smith)\
**Post date:** [October 14, 2020, 5:37pm UTC](https://discuss.elastic.co/t/problems-with-and-in-drop-events-when-or/252066/3 "2020-10-14T17:37:07Z")

</div>

Good catch!

I'm breaking it down to be more simple and I'm still having problems with SYSTEM TargetUserName coming through with just:

```auto
processors:
- drop_event.when.or:
  - equals.event_id: 5379
  - and:
    - equals.winlogbeat_event_data.TargetUserName: SYSTEM

```

but this works just fine:

```auto
processors:
- drop_event.when.or:
  - equals.event_id: 5379
  - equals.winlogbeat_event_data.TargetUserName: SYSTEM

```

Any idea?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 11, 2020, 7:37pm UTC](https://discuss.elastic.co/t/problems-with-and-in-drop-events-when-or/252066/4 "2020-11-11T19:37:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.