Unable to drop events

(Limp15000) #1

I am very to ELK. I've setup a GPO which forwards sysmon and sercurity logs to a server. Then I have winlogbeat which sends the log to logstash. Everything works like a charm except now I am trying to filter the events I am not interested in.
Here is an example

So in Winlogbeat I created the following processor


  • equals.event_data.TargetUserName: $Printer_Maestro$

Unfortunately the logs are still be sent.

Thanks in advance,

(Carlos Pérez Aradros) #2

Hi @limp15000, please use code escaping when pasting settings, they get formatted by discuss if not. I cannot tell but there may be some indenting/formatting issues in your settings. Something like this should work:

  - drop_event.when:
      equals.event_data.TargetUserName: '$Printer_Maestro$'

Best regards

(Limp15000) #3

Excellent this seems to do the trick. Thank you very much for your quick assistance :slight_smile:
May I suggest you update the following documentation :
Which looks wrong or maybe isn't clear enough :slight_smile:

(Limp15000) #4

Sorry seems there is something I am not understanding...
I added drop fields.

   - drop_event.when:
       equals.event_data.TargetUserName: '$Printer_Maestro$'
   - drop_fields.when:
       equals.fields: ['beat.hostname', 'beat.name', 'beat.version']

Maybe some more info, I am using notepad++ to edit the yaml file.

(Carlos Pérez Aradros) #5

You don't need to put when and equals in this case, as you don't put a condition

(Limp15000) #6

lol.... ok works now. Sorry for the dumb questions, quite new to this :stuck_out_tongue:

(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.