# Graylog problem with sidecar and winlogbeat

**URL:** <https://community.graylog.org/t/graylog-problem-with-sidecar-and-winlogbeat/35698>\
**Category:** New to Graylog Community? READ-ME FIRST Guides\
**Created:** [May 22, 2025, 6:50pm UTC](https://community.graylog.org/t/graylog-problem-with-sidecar-and-winlogbeat/35698 "2025-05-22T18:50:25Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kzlatevbg](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/kzlatevbg/32/17829_2.png) [@kzlatevbg](https://community.graylog.org/u/kzlatevbg)\
**Post date:** [May 22, 2025, 6:50pm UTC](https://community.graylog.org/t/graylog-problem-with-sidecar-and-winlogbeat/35698/1 "2025-05-22T18:50:25Z")

</div>

I’m having an issue with Graylog CE. I have Sidecars configured with Winlogbeat, and everything works correctly when using the default configuration. However, when I add a `processors` block, I stop receiving logs — even though I’m actively generating the specified events.

Could you please assist? I’m attaching the current Winlogbeat configuration file as well.

 ![e21e1770464407338389a3ad2258f227c6fbdfa8_2_265x499](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/f/f/ff8c851a8fba36423dfc8a5e350ee70f9b6973a2.png)

---

<div class="post-metadata">

**Author:** ![butta](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/butta/32/17984_2.png) [@butta](https://community.graylog.org/u/butta)\
**Post date:** [May 22, 2025, 7:30pm UTC](https://community.graylog.org/t/graylog-problem-with-sidecar-and-winlogbeat/35698/2 "2025-05-22T19:30:52Z")

</div>

Hi!

Your screenshot is a little small but if I understand your configuration correctly you are trying to send specific event IDs only, right? Also, which version are you on?

I’m personally not using processors blocks so I can’t help with that too much. Not sure if it makes a different but the winlogbeat documentation shows this syntax:

> **[Drop events | Elastic Documentation](https://www.elastic.co/docs/reference/beats/filebeat/drop-event)**
>
> The drop\_event processor drops the entire event if the associated condition is fulfilled. The condition is mandatory, because without one, all the events...

I only find older threads with the syntax you provided (which is also in the docs though).  
Alternatively you could try filtering like this:

```auto
winlogbeat:
  event_logs:
   - name: Security
     ignore_older: 24h
     event_id: 4625,4647,4648,4700-4900,-4776

```

Maybe see if your sidecars start sending logs this way. It works perfectly fine on my end and is a bit simpler.