Hello, I want to monitor File/folder activities on the computers and servers. And I want to drop on the client side all useless/not needed events. As monitoring files activites generate a big amount of logs, can overload the network if thousand of clients and fill the disk space in short time, th…

I found the solution by myself, which is using regexp instead of equals - drop_event.when.or: - equals.winlog.event_data.winlog_task: "Authorization Policy Change" - equals.winlog.event_data.winlog_task: "Registry" - equals.winlog.event_data.winlog_task: "Ker…

Winlogbeat drop event not working for specific fields

Graylog Central (peer support)

system (system) Closed December 18, 2023, 2:24pm 3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Help with Winlogbeat config Graylog Central (peer support) sidecar , winlogbeat	3	3803	December 16, 2019
Winlogbeat drop_event.when.not.or: not working - Sidecar Version 1.5, Graylog 5.2 Graylog Central (peer support) sidecar , winlogbeat	4	834	December 11, 2023
Winlogbeat "publishes" fine but specific events aren't seen in Graylog Graylog Central (peer support) sidecar , winlogbeat	1	1069	April 13, 2021
Drop event_id how to Graylog Central (peer support) sidecar , winlogbeat	9	8580	March 22, 2018
Graylog Sidecar Winlogbeat Drop Event New to Graylog Community? READ-ME FIRST Guides sidecar , windows , winlogbeat	2	402	June 8, 2024

Winlogbeat drop event not working for specific fields

Related topics