# Winlogbeat drop event with process path

**URL:** <https://discuss.elastic.co/t/winlogbeat-drop-event-with-process-path/276430>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [June 19, 2021, 7:57am UTC](https://discuss.elastic.co/t/winlogbeat-drop-event-with-process-path/276430 "2021-06-19T07:57:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![remrem](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/remrem/32/88820_2.png) [@remrem](https://discuss.elastic.co/u/remrem)\
**Post date:** [June 19, 2021, 7:57am UTC](https://discuss.elastic.co/t/winlogbeat-drop-event-with-process-path/276430/1 "2021-06-19T07:57:45Z")

</div>

I want to drop a log for a specific event.code based on process path but it's not working. I have two drop event processor as described below:

```auto
processors:
- drop_event:
    when:
      and:
      - or:
        - equals.event.code: 4658
        - equals.event.code: 4656
        - equals.event.code: 4663
        - equals.event.code: 4690
      - equals.winlog.event_data.SubjectUserName: 'TEST$'
- drop_event:
    when:
      and:
      - or:
        - equals.event.code: 4658
        - equals.event.code: 4656
      - equals.winlog.event_data.ProcessName: 'C:\Program Files\Veeam\Backup and Replication\Console\veeam.backup.shell.exe'
      - equals.winlog.event_data.SubjectUserName: 'test'

```

The first one works fine but the second one doesn't.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 17, 2021, 9:58am UTC](https://discuss.elastic.co/t/winlogbeat-drop-event-with-process-path/276430/2 "2021-07-17T09:58:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.