Sidecar configuration to filter event data for SubjectUserName - Windows

Graylog Central (peer support)
,
5

I decided to move a slightly different direct with the configuration as it works as expected. Finally got it to work with this config:

# Needed for Graylog
fields_under_root: true
fields.collector_node_id: ${sidecar.nodeName}
fields.gl2_source_collector: ${sidecar.nodeId}

output.logstash:
   hosts: ["graylog.ad.example.com:514"]
path:
  data: C:\Program Files\Graylog\sidecar\cache\winlogbeat\data
  logs: C:\Program Files\Graylog\sidecar\logs
tags:
 - windows
winlogbeat:
  event_logs:
   - name: Application
     level: critical, error, warning
     ignore_older: 72h
   - name: System
     level: critical, error, warning
     ignore_older: 72h
   - name: Security
     processors:
     - drop_event.when.or:
       - equals.winlog.event_data.SubjectUserSid: 'S-1-5-18'
     level: critical, error, warning, information
     ignore_older: 72h
1 Like