# Winlogbeat configuration - exact selection **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [June 5, 2020, 6:57am UTC](https://discuss.elastic.co/t/winlogbeat-configuration-exact-selection/235895 "2020-06-05T06:57:19Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![RRadim](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@RRadim](https://discuss.elastic.co/u/RRadim)\ **Post date:** [June 5, 2020, 6:57am UTC](https://discuss.elastic.co/t/winlogbeat-configuration-exact-selection/235895/1 "2020-06-05T06:57:19Z")
Hello 🙂 Hope someone could help me 😉 I want to collect ALL events of level Critical, Error and Warning + from level Information JUST events id 1074, 6005, 6006, 6008. (Due to monitoring restart/shutdown of servers). How to configure it? 🤔 I tried this, but it did not work : ```auto - name: System ignore_older: 10h level: critical, error, warning level: information event_id: 1074, 6005, 6006, 6008 ``` I received only Information events id 1074, 6005, 6006, 6008 but NO events of Critical, Error and Warning level ☹ ---
**Author:** ![Coinology](https://avatars.discourse-cdn.com/v4/letter/c/3e96dc/32.png) [@Coinology](https://discuss.elastic.co/u/Coinology)\ **Post date:** [June 6, 2020, 5:34pm UTC](https://discuss.elastic.co/t/winlogbeat-configuration-exact-selection/235895/2 "2020-06-06T17:34:31Z")
@RRadim I'm not 100% on this, but I believe the issue is that you have two entries for `level`. When the YAML is being parsed, it is probably overwriting itself with `information` thus you are only getting `information` level events. Assuming you do want information as well, try this instead: ``` - name: System ignore_older: 10h level: information, critical, error, warning event_id: 1074, 6005, 6006, 6008 ``` ---
**Author:** ![RRadim](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@RRadim](https://discuss.elastic.co/u/RRadim)\ **Post date:** [June 8, 2020, 6:17am UTC](https://discuss.elastic.co/t/winlogbeat-configuration-exact-selection/235895/3 "2020-06-08T06:17:15Z")
Unfortunately, it doesn't work ☹ NO critical, error or warning level events .... only information level events 1074, 6005, 6006, 6008. Any other idea? Maybe using of ''processors'' ... but I have no experience with them. ---
**Author:** ![mazoutte](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mazoutte/32/120188_2.png) [@mazoutte](https://discuss.elastic.co/u/mazoutte)\ **Post date:** [June 8, 2020, 8:38am UTC](https://discuss.elastic.co/t/winlogbeat-configuration-exact-selection/235895/4 "2020-06-08T08:38:15Z")
Hello, Firstly, make sure the events you want have different levels : info, error etc... Probably your events generate only with informational level - and it's a case I see a lot. Please have a check in your event viewer directly on your machine to analyze that point first. Secondly, you can just drop the 'level' section in your conf if you want everything. Regards Luc ---
**Author:** ![RRadim](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@RRadim](https://discuss.elastic.co/u/RRadim)\ **Post date:** [June 8, 2020, 10:56am UTC](https://discuss.elastic.co/t/winlogbeat-configuration-exact-selection/235895/5 "2020-06-08T10:56:38Z")
1. Yes, there is a lot of SYSTEM events with ERROR or WARNING level. 2. No, I do not want collect/monitor everything! I do not want events with INFORMATION level (except event\_id: 1074, 6005, 6006, 6008 ) ---
**Author:** ![mazoutte](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mazoutte/32/120188_2.png) [@mazoutte](https://discuss.elastic.co/u/mazoutte)\ **Post date:** [June 9, 2020, 7:29am UTC](https://discuss.elastic.co/t/winlogbeat-configuration-exact-selection/235895/6 "2020-06-09T07:29:53Z")
Hello, 1. My point is that for events you mentioned 1074, 6005, 6006 and 6008, the level 'can' be always information in the event viewer. 2. If you remove the level section in the config file AND you have configured 4 event\_id ; you will send ONLY these **4 event\_id** whatever the level type. Regards, Luc ---
**Author:** ![RRadim](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@RRadim](https://discuss.elastic.co/u/RRadim)\ **Post date:** [June 9, 2020, 11:13am UTC](https://discuss.elastic.co/t/winlogbeat-configuration-exact-selection/235895/7 "2020-06-09T11:13:42Z")
Thank you for your contributions, but I haven't moved anywhere yet ☹ Does anyone have any working configuration code for my problem? ---
**Author:** ![mazoutte](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mazoutte/32/120188_2.png) [@mazoutte](https://discuss.elastic.co/u/mazoutte)\ **Post date:** [June 11, 2020, 8:51am UTC](https://discuss.elastic.co/t/winlogbeat-configuration-exact-selection/235895/8 "2020-06-11T08:51:23Z")
Hello, Based on what I understand, you want only the 4 events Id's ( 1074, 6005, 6006, 6008) right ? And these 4 events exist with different 'level'. You can try this : ```auto - name: System ignore_older: 10h event_id: 1074,6005,6006,6008 ``` As I told, you need to analyze first if you have different level for the mentioned events in your event viewer. Maybe I misunderstand what you're looking for... ---
**Author:** ![mazoutte](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mazoutte/32/120188_2.png) [@mazoutte](https://discuss.elastic.co/u/mazoutte)\ **Post date:** [June 11, 2020, 9:12am UTC](https://discuss.elastic.co/t/winlogbeat-configuration-exact-selection/235895/9 "2020-06-11T09:12:09Z")
Sorry, I read again your inital post, and I totally misread at first. You can try this : ```auto - name: System ignore_older: 10h level: information event_id: 1074,6005,6006,6008 - name: System ignore_older: 10h level: critical, error, warning ``` Edit : we can use a drop\_event processor if needed. If it works, then we can do some tweaks. ---
**Author:** ![RRadim](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@RRadim](https://discuss.elastic.co/u/RRadim)\ **Post date:** [June 11, 2020, 12:21pm UTC](https://discuss.elastic.co/t/winlogbeat-configuration-exact-selection/235895/10 "2020-06-11T12:21:47Z")
Yes! It works! You're great 🙂 And for interest : How would you handle it with a processor ? 😉 ---
**Author:** ![mazoutte](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mazoutte/32/120188_2.png) [@mazoutte](https://discuss.elastic.co/u/mazoutte)\ **Post date:** [June 11, 2020, 2:09pm UTC](https://discuss.elastic.co/t/winlogbeat-configuration-exact-selection/235895/11 "2020-06-11T14:09:25Z")
Maybe something like this could work for your case : ``` - name: System ignore_older: 10h processors: - drop_event.when: - and: - equals.log.level: 'information' - not.equals.winlog.event_id: 1074,6005,6006,6008 ``` Which means : we drop all events with information level - except from the 4 events. Note : I didn't test it ... so maybe it's not working, but the logic is here. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 9, 2020, 4:09pm UTC](https://discuss.elastic.co/t/winlogbeat-configuration-exact-selection/235895/12 "2020-07-09T16:09:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.