Winlogbeat match eventdata param1

[Siva_]

Hi community,

How can i use the eventdata param1 to filter in winlogbeat?

currently, I am using regex on the message but hoping to avoid it for performance.

processors:
- drop_event:
   when:
    not:
     regexp:
      message: "The Citrix Universal Printing Service*"

[bigphil (Philip Nunn)]

This is the field name that contains the data in param1: event_data.param1

[Siva_]

@Siva_

Citrix Universal Printing Service

Thank you!

winlogbeat.event_logs:
  - name: System
    provider:
        - Service Control Manager
    event_id: 7036, 7031
    tags: ["citrix","ups"]  
    ignore_older: 5m
    processors:
    - drop_event:
       when:
        not:
         equals:
          event_data.param1: "Citrix Universal Printing Service"