# Processor \[drop\_event\] not dropping events Beats Winlogbeat

**URL:** https://discuss.elastic.co/t/processor-drop-event-not-dropping-events-beats-winlogbeat/188732
**Category:** Beats
**Tags:** winlogbeat
**Created:** [July 3, 2019, 1:56pm UTC](https://discuss.elastic.co/t/processor-drop-event-not-dropping-events-beats-winlogbeat/188732 "2019-07-03T13:56:34Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![EFr](https://avatars.discourse-cdn.com/v4/letter/e/ed8c4c/32.png) [@EFr](https://discuss.elastic.co/u/EFr)
#### Post date: [July 3, 2019, 1:56pm UTC](https://discuss.elastic.co/t/processor-drop-event-not-dropping-events-beats-winlogbeat/188732/1 "2019-07-03T13:56:34Z")

</div>

ver 7.2.0

I'm unable to filter the unwanted LogonType  
.\winlogbeat.exe test config -c .\winlogbeat.yml -e says the cfg is ok  
I've tried  
- equals.event\_data.LogonType: 0  
or  
- equals.event\_data.LogonType: '0'  
as i've tried to move the filter to global processor with no result.  
For sure my mistake but i dont know where to look.

Thanks in advance

Here's the winlogbeat.yml

```
output.logstash: 
  hosts: 
    - "1.2.3.4:5044"
processors: 
  - add_host_metadata: ~
  - add_cloud_metadata: ~

setup.template.settings: 
  index.number_of_shards: 1

winlogbeat.event_logs:
  - name: Security
    event_id: 4624,4625,4634,4648,4771
    ignore_older: 72h    
    processors:
      - drop_event.when.or: 
        - equals.event_data.LogonType: "0"
        - equals.event_data.LogonType: "3"
        - equals.event_data.LogonType: "5"
```

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [July 3, 2019, 2:39pm UTC](https://discuss.elastic.co/t/processor-drop-event-not-dropping-events-beats-winlogbeat/188732/2 "2019-07-03T14:39:29Z")

</div>

Isn’t the field you are trying to filter on actually called winlog.event\_data.LogonType?

---

<div class="post-metadata">

### Author: ![EFr](https://avatars.discourse-cdn.com/v4/letter/e/ed8c4c/32.png) [@EFr](https://discuss.elastic.co/u/EFr)
#### Post date: [July 3, 2019, 3:09pm UTC](https://discuss.elastic.co/t/processor-drop-event-not-dropping-events-beats-winlogbeat/188732/3 "2019-07-03T15:09:49Z")

</div>

Correct the problem was the field name i take from a sample.  
The right filed name is winlog.event\_data.LogonType as you say

Many thanks  
Regards

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 31, 2019, 3:09pm UTC](https://discuss.elastic.co/t/processor-drop-event-not-dropping-events-beats-winlogbeat/188732/4 "2019-07-31T15:09:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.