Winlogbeat match eventdata param1

Elastic Stack Beats
1

Hi community,

How can i use the eventdata param1 to filter in winlogbeat?

image

currently, I am using regex on the message but hoping to avoid it for performance.

processors:
- drop_event:
   when:
    not:
     regexp:
      message: "The Citrix Universal Printing Service*"
2

This is the field name that contains the data in param1: event_data.param1

3

Thank you!

winlogbeat.event_logs:
  - name: System
    provider:
        - Service Control Manager
    event_id: 7036, 7031
    tags: ["citrix","ups"]  
    ignore_older: 5m
    processors:
    - drop_event:
       when:
        not:
         equals:
          event_data.param1: "Citrix Universal Printing Service"
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.