hello what would the solution be in winlogbeat.yml to this example from filelogbeat below i want to do special filtering on powershell logs and thus tag them or similar once it get to logstash here is my config from winlogbeat.yml winlogbeat.event_logs: - name: "Microsoft-Windows-Sysmon/Operati…

system (system) Closed December 30, 2017, 10:00pm 6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Filtering Windows Events - Beats winlogbeat	6	4018	June 15, 2017
Filter event from Winlogbeat Logstash	6	743	September 6, 2018
Winlogbeat - Event Tagging and Overriding 'type' in Logstash Beats winlogbeat	3	3404	April 12, 2016
Winlogbeats not exporitng event.id or xml data Beats winlogbeat	10	1284	July 6, 2018
Winlogbeat processor for powershell module Beats winlogbeat	3	565	October 20, 2020

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Tagging event logs in Winlogbeat in order to filter in Logstash

Related topics