Unable to drop events

[limp15000]

Hi,
I am very to ELK. I've setup a GPO which forwards sysmon and sercurity logs to a server. Then I have winlogbeat which sends the log to logstash. Everything works like a charm except now I am trying to filter the events I am not interested in.
Here is an example

So in Winlogbeat I created the following processor

processors:
-drop_event.when:

• equals.event_data.TargetUserName: Printer_Maestro

Unfortunately the logs are still be sent.

Thanks in advance,
Thomas

[exekias (Carlos Pérez Aradros)]

Hi @limp15000, please use code escaping when pasting settings, they get formatted by discuss if not. I cannot tell but there may be some indenting/formatting issues in your settings. Something like this should work:

processors:
  - drop_event.when:
      equals.event_data.TargetUserName: '$Printer_Maestro$'

Best regards

[limp15000]

@exekias

processors: - drop_event.when: equals.event_data.TargetUserName: '$Printer_Maestro$'

Excellent this seems to do the trick. Thank you very much for your quick assistance
May I suggest you update the following documentation :

Drop events | Winlogbeat Reference [8.11] | Elastic

Which looks wrong or maybe isn't clear enough

[limp15000]

Sorry seems there is something I am not understanding...
I added drop fields.

 processors:
   - drop_event.when:
       equals.event_data.TargetUserName: '$Printer_Maestro$'
   - drop_fields.when:
       equals.fields: ['beat.hostname', 'beat.name', 'beat.version']

Maybe some more info, I am using notepad++ to edit the yaml file.

[exekias (Carlos Pérez Aradros)]

You don't need to put when and equals in this case, as you don't put a condition

[limp15000]

lol.... ok works now. Sorry for the dumb questions, quite new to this