Hey guys, cheers, i really need help to drop some events at my active directory, it’s eating my disk space, xD, I have issue with filtering system logons which occur in events 4624 and 4634, i only want to filter real logged-in and logged-out events, i want to drop events from SYSTEM, LOCAL SERVICE,…

Guys.. i solved it. It was my bad since the begin, i was using the processors to drop the events inside of the block output.elasticsearch, but the correct way is inside of the winlogbeat.event_logs.. lmao. Thanks for all your help. Example below has worked properly. winlogbeat.event_logs: # Log…

Discuss the Elastic Stack

Winlogbeat isn't dropping event

Elastic Stack Beats

leandrojmp (Leandro Pereira) August 14, 2025, 1:35pm 6

If I'm not wrong this is populated by the ingest pipeline, the parsing/enrichment of winlogbeat data was moved from the edge to elasticsearch ingest pipelines some time ago.

Topic		Replies	Views
Filter system logons Beats winlogbeat	11	2039	May 13, 2020
Never dropping the events Beats winlogbeat	15	1915	March 6, 2019
Processor not dropping events Beats Winlogbeat Beats winlogbeat	3	859	April 29, 2021
Filtering not working Beats winlogbeat	8	750	July 9, 2020
Processor [drop_event] not dropping events Beats Winlogbeat Beats winlogbeat	3	668	July 31, 2019

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Winlogbeat isn't dropping event

Related topics