Drop events using the sidecar collector

[gsmith]

Hello && Welcome @maiconjs

Perhaps this post may help

• Sidecar configuration to filter event data for SubjectUserName - Windows - #5 by quinniedid

Or some type of configuration like this.

winlogbeat.event_logs:
  - name: Application
    ignore_older: 72h

  - name: System

  - name: Security
    event_id: 4625, 4626

  - name: Windows PowerShell
    event_id: 400, 403, 600, 800

  - name: Microsoft-Windows-PowerShell/Operational
    event_id: 4103, 4104, 4105, 4106