# Winlogbeat drop specific system events

**URL:** <https://discuss.elastic.co/t/winlogbeat-drop-specific-system-events/247275>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [September 2, 2020, 5:45pm UTC](https://discuss.elastic.co/t/winlogbeat-drop-specific-system-events/247275 "2020-09-02T17:45:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![StlAR](https://avatars.discourse-cdn.com/v4/letter/s/f14d63/32.png) [@StlAR](https://discuss.elastic.co/u/StlAR)\
**Post date:** [September 2, 2020, 5:45pm UTC](https://discuss.elastic.co/t/winlogbeat-drop-specific-system-events/247275/1 "2020-09-02T17:45:32Z")

</div>

I'm looking to collect specific System events. I would like all error and warning events. Only 36880 information events. And finally ignore older than 72 hours. This code checks out but still including information events outside 36880. Warning and Errors are still being collected as intended.

```auto
  - name: System
    ignore_older: 72h  
    processors:
     - drop_event.when.and:
        - equals.level: information
        - not.equals.event_id: 36880

```

---

<div class="post-metadata">

**Author:** ![mazoutte](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mazoutte/32/120188_2.png) [@mazoutte](https://discuss.elastic.co/u/mazoutte)\
**Post date:** [September 3, 2020, 1:30pm UTC](https://discuss.elastic.co/t/winlogbeat-drop-specific-system-events/247275/2 "2020-09-03T13:30:28Z")

</div>

Hello,

Could you please check the fields names in your data ; because depending your Winlogbeat version these fields are named differently.

Example on a 7.6 agents :  
winlog.event\_id  
log.level

Your code then would be like this :

```auto
 - name: System
   ignore_older: 72h  
   processors:
    - drop_event.when.and:
       - equals.log.level: information
       - not.equals.winlog.event_id: 36880

```

Regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 1, 2020, 3:30pm UTC](https://discuss.elastic.co/t/winlogbeat-drop-specific-system-events/247275/3 "2020-10-01T15:30:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.