Extracting wineventlog from Azure EventHub WindowsEventLogsTable

kajmaple — Tue, 28 Jan 2025 14:11:25 GMT

Hey,

We are currently ingesting wineventlog from some of our Azure VMs via Eventhub. As such, their assigned sourcetype is the eventhub sourcetype, which means they are not subject to the wineventlog field extractions.

These logs do contain a "raw xml" data field, which is like xmlwineventlog, however, using things such as xmlkv, spath or xpath don't work as intended, and require additional work to extract the data correctly. Unfortunately due to this, we are unable to dump this extra SPL into a field extraction or calculated field.

Please find the SPL below:

index=azure sourcetype=mscs:azure:eventhub category="WindowsEventLogsTable" | fields properties.RawXml | spath input=properties.RawXml | eval test=mvzip('Event.EventData.Data{@Name}', 'Event.EventData.Data', "=") | mvexpand test | rex field=test max_match=0 "^(?<kv_key>[^=]+)=(?<kv_value>[^=]+)$" | eval {kv_key}=kv_value

The end goal with this is to successfully extract the relevant windows event fields so that it can be datamodel mapped. It's not possible to install UFs onto these VMs, so unfortunately not the solution here. We'd ideally also want to avoid using "collect" to duplicate the data to a separate index/sourcetype.

Has anyone else encountered this and managed to come up with a solution? Thanks

topic Extracting wineventlog from Azure EventHub WindowsEventLogsTable in Getting Data In

Extracting wineventlog from Azure EventHub WindowsEventLogsTable