# Unable to drop events

**URL:** <https://discuss.elastic.co/t/unable-to-drop-events/133993>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [May 31, 2018, 7:49am UTC](https://discuss.elastic.co/t/unable-to-drop-events/133993 "2018-05-31T07:49:21Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![limp15000](https://avatars.discourse-cdn.com/v4/letter/l/3d9bf3/32.png) [@limp15000](https://discuss.elastic.co/u/limp15000)\
**Post date:** [May 31, 2018, 7:49am UTC](https://discuss.elastic.co/t/unable-to-drop-events/133993/1 "2018-05-31T07:49:22Z")

</div>

Hi,  
I am very to ELK. I've setup a GPO which forwards sysmon and sercurity logs to a server. Then I have winlogbeat which sends the log to logstash. Everything works like a charm except now I am trying to filter the events I am not interested in.  
Here is an example

 ![filter](https://us1.discourse-cdn.com/elastic/original/3X/a/9/a9fa1ea43e480fe3e3d008d8a67463f8d4ff6df2.PNG)

So in Winlogbeat I created the following processor

processors:  
-drop\_event.when:

- equals.event\_data.TargetUserName: Printer\_Maestro

Unfortunately the logs are still be sent.

Thanks in advance,  
Thomas

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [May 31, 2018, 10:31am UTC](https://discuss.elastic.co/t/unable-to-drop-events/133993/2 "2018-05-31T10:31:24Z")

</div>

Hi @limp15000, please use code escaping when pasting settings, they get formatted by discuss if not. I cannot tell but there may be some indenting/formatting issues in your settings. Something like this should work:

```auto
processors:
  - drop_event.when:
      equals.event_data.TargetUserName: '$Printer_Maestro$'

```

Best regards

---

<div class="post-metadata">

**Author:** ![limp15000](https://avatars.discourse-cdn.com/v4/letter/l/3d9bf3/32.png) [@limp15000](https://discuss.elastic.co/u/limp15000)\
**Post date:** [May 31, 2018, 11:34am UTC](https://discuss.elastic.co/t/unable-to-drop-events/133993/3 "2018-05-31T11:34:44Z")

</div>

> [@exekias](#):
>
> processors: - drop\_event.when: equals.event\_data.TargetUserName: '$Printer\_Maestro$'

Excellent this seems to do the trick. Thank you very much for your quick assistance 🙂  
May I suggest you update the following documentation :

> **[Drop events | Winlogbeat Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/beats/winlogbeat/current/drop-event.html)**

Which looks wrong or maybe isn't clear enough 🙂

---

<div class="post-metadata">

**Author:** ![limp15000](https://avatars.discourse-cdn.com/v4/letter/l/3d9bf3/32.png) [@limp15000](https://discuss.elastic.co/u/limp15000)\
**Post date:** [May 31, 2018, 12:41pm UTC](https://discuss.elastic.co/t/unable-to-drop-events/133993/4 "2018-05-31T12:41:13Z")

</div>

Sorry seems there is something I am not understanding...  
I added drop fields.

```
 processors:
   - drop_event.when:
       equals.event_data.TargetUserName: '$Printer_Maestro$'
   - drop_fields.when:
       equals.fields: ['beat.hostname', 'beat.name', 'beat.version']

```

Maybe some more info, I am using notepad++ to edit the yaml file.  
 ![logbeat](https://us1.discourse-cdn.com/elastic/original/3X/5/6/5642b2768dd9424dbfb2b4b5d13b8d1d11ff7d2a.PNG)

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [May 31, 2018, 12:59pm UTC](https://discuss.elastic.co/t/unable-to-drop-events/133993/5 "2018-05-31T12:59:45Z")

</div>

You don't need to put `when` and `equals` in this case, as you don't put a condition

---

<div class="post-metadata">

**Author:** ![limp15000](https://avatars.discourse-cdn.com/v4/letter/l/3d9bf3/32.png) [@limp15000](https://discuss.elastic.co/u/limp15000)\
**Post date:** [May 31, 2018, 1:02pm UTC](https://discuss.elastic.co/t/unable-to-drop-events/133993/6 "2018-05-31T13:02:06Z")

</div>

lol.... ok works now. Sorry for the dumb questions, quite new to this 😛

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 28, 2018, 1:02pm UTC](https://discuss.elastic.co/t/unable-to-drop-events/133993/7 "2018-06-28T13:02:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.