Winlogbeat - exclude specific event_id - Energy Logserver Community

Winlogbeat - exclude specific event_id

Question

Hi,

Is it possible to exclude a specific event_id in the winlogbeat configuration?

MariuszL

The processors block should be expanded so that it looks similar to:

processors:

add_host_metadata:
when.not.contains.tags: forwarded
add_cloud_metadata: ~
drop_event:
when.equals.event_id: 4690