topic Re: How can I disable a windows event id from indexing? in Getting Data In

How can I disable a windows event id from indexing?

troywjonescc — Mon, 28 Nov 2022 18:17:34 GMT

I have an event id 4674 that I would like to block from being indexed. I have the following in my in inputs.conf in local not default.

[WinEventLog://Security]

disabled = true

blacklist1 = EventCode = "4764" Message="*"

Re: How can I disable a windows event id from indexing?

richgalloway — Mon, 28 Nov 2022 18:44:02 GMT

The input stanza is disabled so there should be no Security events coming in. If you're still getting them then it could be because: 1) the inputs.conf is not loaded on the right instance (UF); 2) the instance was not restarted after props.conf was modified; or 3) the event is not a Security event.

Also, try specifying the EventCode alone in the deny list.

blacklist1 = 4764

Re: How can I disable a windows event id from indexing?

troywjonescc — Mon, 28 Nov 2022 18:55:23 GMT

Do I need to add those lines to the props.conf as well? Where do I put that deny list at?

Re: How can I disable a windows event id from indexing?

richgalloway — Mon, 28 Nov 2022 21:46:27 GMT

Use my example blacklist1 setting as a replacement for the one in the OP. Make sure the props.conf file is installed on the Windows UFs.