I am try to filter a windows log using Winlogbeat using the following parameters. I want events to be dropped in case: EventID = 4668 SubjectUserSid = “S-1-5-18" I have searched everything and I do not even whether this filtering is possible using winlogbeat. I have followed the guide from elas…

Yes, I posted the Graylog pipeline solution. If you want it to work in the Collector Configuration it would look something like this: - name: Security processors: - drop_event.when: and: - equals.winlog.event_id: "4688" - equals.winlog.event_data…

How to filter on WinlogBeat configuration. EventID & SubjectUserSid

Graylog Central (peer support)

gsmith (GSmith) March 10, 2023, 11:18pm 2

Hello && welcome @Kyriakos

You can use a piepline to drop the messages you dont want or filter message you only want to send.
Here is an example:

Winlogbeat Collector Configuration Not Working

Topic		Replies	Views
Deleting event logs before Elasticsearch Graylog Central (peer support) sidecar , winlogbeat	4	1114	April 29, 2019
Removing some messages from winlogbeat inputs Graylog Central (peer support)	10	669	August 17, 2022
Windows Logon Session Time Monitoring Graylog Central (peer support) pipeline-rules , windows , winlogbeat , alert , timestamp	4	395	December 28, 2023
Can I drop events based on the Process Name? Graylog Central (peer support) winlogbeat	2	484	March 28, 2023
Drop "same events within 1 secound" Graylog Central (peer support) pipeline-rules , sidecar , winlogbeat	5	706	December 17, 2019

How to filter on WinlogBeat configuration. EventID & SubjectUserSid

Related Topics