# Winlogbeat doesn't drop events

**URL:** <https://discuss.elastic.co/t/winlogbeat-doesnt-drop-events/332557>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [May 4, 2023, 1:09pm UTC](https://discuss.elastic.co/t/winlogbeat-doesnt-drop-events/332557 "2023-05-04T13:09:43Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![h49nakxs](https://avatars.discourse-cdn.com/v4/letter/h/e68b1a/32.png) [@h49nakxs](https://discuss.elastic.co/u/h49nakxs)\
**Post date:** [May 4, 2023, 1:09pm UTC](https://discuss.elastic.co/t/winlogbeat-doesnt-drop-events/332557/1 "2023-05-04T13:09:44Z")

</div>

Hi there,

How the hell are we supposed to configure winlogbeats (ecs.version : 1.6.0) to drop events ?  
I've tried, many, many variations, but none of them worked.

```auto
  - name: Security
    processors:
      - drop_event.when.or:
        - equals.winlog.event_id: 5152

```

It doesn't work.

```auto
  - name: Security
    processors:
      - drop_event.when.and:
        - equals.winlog.event_id: 5152

```

Does not work.

```auto
  - name: Security
    processors:
      - drop_event.when:
          and:
            - equals:
                winlog.event_data.EventId: 5152

```

Does not work.

```auto
  - name: Security
    processors:
      - drop_event.when.or:
        - equals.event_code: 5152

```

Does it work ? No.

```auto
  - name: Security
    processors:
      - drop_event.when.or:
        - equals.winlog_event_id: 5152

```

No.

```auto
 - name: Security
   processors:
    - drop_event.when.and:
       - equals.event_id: 5152

```

Guess what ? It doesn't work.

```auto
 - name: Security
   processors:
    - drop_event.when.and:
       - equals.event_id: '5152'

```

No luck.

```auto
  - name: Security
    processors:
      - drop_event.when.and:
        - equals:
          event.code: 5152

```

Winlogbeat doesn't even start.

Thanks

---

<div class="post-metadata">

**Author:** ![mazoutte](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mazoutte/32/120188_2.png) [@mazoutte](https://discuss.elastic.co/u/mazoutte)\
**Post date:** [May 4, 2023, 2:40pm UTC](https://discuss.elastic.co/t/winlogbeat-doesnt-drop-events/332557/2 "2023-05-04T14:40:35Z")

</div>

Hello,

You must simple quote the event\_id number. On all your tests, you didn't try this (simple quotes + or statement ) :

```auto
   processors:
    - drop_event.when.or:
       - equals.winlog.event_id: '5152'

```

The "or" will give the opportunity to add more events to be dropped that way.

```auto
   processors:
    - drop_event.when.or:
       - equals.winlog.event_id: '5152'
       - equals.winlog.event_id: '5153'

```

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [May 4, 2023, 3:30pm UTC](https://discuss.elastic.co/t/winlogbeat-doesnt-drop-events/332557/3 "2023-05-04T15:30:08Z")

</div>

ECS `event.code` and Winlogbeat's `winlog.event_id` are both strings.

The `equals` conditions only matches when the data types are the same. So like @mazoutte said, add quotes to the value to make it a string.

```yaml
- drop_event:
    when:
      or:
        - equals.event.code: '4124'
        - equals.event.code: '4126'

```

---

<div class="post-metadata">

**Author:** ![h49nakxs](https://avatars.discourse-cdn.com/v4/letter/h/e68b1a/32.png) [@h49nakxs](https://discuss.elastic.co/u/h49nakxs)\
**Post date:** [May 9, 2023, 11:54am UTC](https://discuss.elastic.co/t/winlogbeat-doesnt-drop-events/332557/4 "2023-05-09T11:54:26Z")

</div>

OK, thank you very much for both your answers.  
Sorry for the harsh tone of my initial post, I was a bit frustrated...

---

<div class="post-metadata">

**Author:** ![Devdem](https://avatars.discourse-cdn.com/v4/letter/d/958977/32.png) [@Devdem](https://discuss.elastic.co/u/Devdem)\
**Post date:** [May 10, 2023, 1:08pm UTC](https://discuss.elastic.co/t/winlogbeat-doesnt-drop-events/332557/5 "2023-05-10T13:08:27Z")

</div>

Oh my gosh, this is exactly why mine weren't being filtered! I totally felt and shared your frustration in the first post. Thanks for helping me out in turn!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 7, 2023, 3:08pm UTC](https://discuss.elastic.co/t/winlogbeat-doesnt-drop-events/332557/6 "2023-06-07T15:08:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.