Hi there. I am trying to send specific windows event logs to a pipeline based on event_id in my winlogbeat.yml config file. However, when the conditional is added to the config file, it appears to bypass the pipeline completely. The error logs seem to indicate that event_id is being seen as a non-string datatype, and that's why the when.contains fails
I'm running winlogbeat 6.8.10, as my ELK stack is part of a Security Onion setup.
output.elasticsearch: hosts: ["hostname:9200"] pipelines: - pipeline: "mypipeline" when.contains: event_id: "1210"
And the error I'm seeing in the log:
2020-10-05T15:41:40.134-0700 WARN conditions/matcher.go:97 unexpected type uint32 in contains condition as it accepts only strings.
I'm open to any options. The ultimate goal is to be able to send logs to various pipelines based on event_id.