cat monlogdesecu.json | jq 'select(.event.code == "4624")'

#Ou
cat monlogdesecu.json | jq 'select(.event.code | IN("4624", "4634"))'
cat monlogdesecu.json | jq 'select((.event.code | IN("4624", "4634")) and ((.user.name | ascii_downcase) == "leloginrecherche"))'

cat monlogdesecu.json| jq 'del(.message) | select((.event.code | IN("4624", "4634")) and ((.user.name | ascii_downcase) == "leloginrecherche"))'