# Send event logs to pipeline based on event\_id

**URL:** <https://discuss.elastic.co/t/send-event-logs-to-pipeline-based-on-event-id/251150>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [October 6, 2020, 2:37pm UTC](https://discuss.elastic.co/t/send-event-logs-to-pipeline-based-on-event-id/251150 "2020-10-06T14:37:43Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![tedfs](https://avatars.discourse-cdn.com/v4/letter/t/258eb7/32.png) [@tedfs](https://discuss.elastic.co/u/tedfs)\
**Post date:** [October 6, 2020, 2:37pm UTC](https://discuss.elastic.co/t/send-event-logs-to-pipeline-based-on-event-id/251150/1 "2020-10-06T14:37:44Z")

</div>

Hi there. I am trying to send specific windows event logs to a pipeline based on event\_id in my winlogbeat.yml config file. However, when the conditional is added to the config file, it appears to bypass the pipeline completely. The error logs seem to indicate that event\_id is being seen as a non-string datatype, and that's why the when.contains fails

I'm running winlogbeat 6.8.10, as my ELK stack is part of a Security Onion setup.

Relevant config:

```auto
output.elasticsearch:
  hosts: ["hostname:9200"]
  pipelines:
    - pipeline: "mypipeline"
      when.contains:
        event_id: "1210"

```

And the error I'm seeing in the log:

```auto
2020-10-05T15:41:40.134-0700	WARN	conditions/matcher.go:97	unexpected type uint32 in contains condition as it accepts only strings.

```

I'm open to any options. The ultimate goal is to be able to send logs to various pipelines based on event\_id.

Thanks!

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [October 6, 2020, 7:36pm UTC](https://discuss.elastic.co/t/send-event-logs-to-pipeline-based-on-event-id/251150/2 "2020-10-06T19:36:51Z")

</div>

How about using `when.equals.event_id: 1210`? I think the equality condition should work for numbers.

---

<div class="post-metadata">

**Author:** ![tedfs](https://avatars.discourse-cdn.com/v4/letter/t/258eb7/32.png) [@tedfs](https://discuss.elastic.co/u/tedfs)\
**Post date:** [October 6, 2020, 8:07pm UTC](https://discuss.elastic.co/t/send-event-logs-to-pipeline-based-on-event-id/251150/3 "2020-10-06T20:07:25Z")

</div>

I will give it a try and update this post with the result. Thank you.

Also, if you don't mind, can you point me to where I can find more documentation about things like conditions that can be used in beats config files? I have been using this as a guide thus far: [https://www.elastic.co/guide/en/beats/winlogbeat/6.8/elasticsearch-output.html](https://www.elastic.co/guide/en/beats/winlogbeat/6.8/elasticsearch-output.html)

Thank you again.

---

<div class="post-metadata">

**Author:** ![tedfs](https://avatars.discourse-cdn.com/v4/letter/t/258eb7/32.png) [@tedfs](https://discuss.elastic.co/u/tedfs)\
**Post date:** [October 6, 2020, 8:46pm UTC](https://discuss.elastic.co/t/send-event-logs-to-pipeline-based-on-event-id/251150/4 "2020-10-06T20:46:47Z")

</div>

That worked. Thank you!

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [October 6, 2020, 8:58pm UTC](https://discuss.elastic.co/t/send-event-logs-to-pipeline-based-on-event-id/251150/5 "2020-10-06T20:58:13Z")

</div>

Docs for processors and conditions are at [https://www.elastic.co/guide/en/beats/winlogbeat/current/defining-processors.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/defining-processors.html). Choose your version on the right hand side dropdown menu.

---

<div class="post-metadata">

**Author:** ![tedfs](https://avatars.discourse-cdn.com/v4/letter/t/258eb7/32.png) [@tedfs](https://discuss.elastic.co/u/tedfs)\
**Post date:** [October 7, 2020, 2:12pm UTC](https://discuss.elastic.co/t/send-event-logs-to-pipeline-based-on-event-id/251150/6 "2020-10-07T14:12:21Z")

</div>

Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2020, 4:12pm UTC](https://discuss.elastic.co/t/send-event-logs-to-pipeline-based-on-event-id/251150/7 "2020-11-04T16:12:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.