---
description: Winlogbeat Routing Pipeline
processors:
  - set:
      field: event.ingested
      value: '{{_ingest.timestamp}}'
  - pipeline:
      name: '{< IngestPipeline "security" >}'
      if: ctx?.winlog?.channel == 'Security' && ['Microsoft-Windows-Eventlog', 'Microsoft-Windows-Security-Auditing'].contains(ctx?.winlog?.provider_name)
  - pipeline:
      name: '{< IngestPipeline "sysmon" >}'
      if: ctx?.winlog?.channel == 'Microsoft-Windows-Sysmon/Operational'
  - pipeline:
      name: '{< IngestPipeline "powershell" >}'
      if: ctx?.winlog?.channel == 'Windows PowerShell'
  - pipeline:
      name: '{< IngestPipeline "powershell_operational" >}'
      if: ctx?.winlog?.channel == 'Microsoft-Windows-PowerShell/Operational'
on_failure:
  - set:
      field: error.message
      value: |-
        Processor "{{ _ingest.on_failure_processor_type }}" with tag "{{ _ingest.on_failure_processor_tag }}" in pipeline "{{ _ingest.on_failure_pipeline }}" failed with message "{{ _ingest.on_failure_message }}"
