topic Re: Filter all windows event logs from single server in Getting Data In

Filter all windows event logs from single server

timmy13 — Thu, 14 Jun 2012 15:57:28 GMT

I need to filter all windows event log records from being indexed. I am using the universal forwarder, so on my indexers, I have the following:

props.conf

[host::myserver]
TRANSFORMS-winlogs = FilterWinSecurityLogs

transforms.conf

[FilterWinSecurityLogs]
REGEX=sourcetype=(WMI*|WinEvent*)
DEST_KEY=queue
FORMAT=nullQueue

THis doesn't seem to work.

Is the * wildcard valid in the REGEX valid?

Thanks!

kristian_kolb — Thu, 14 Jun 2012 16:41:09 GMT

The best would naturally be to disable the monitoring on the host in question.

If this (for some odd reason) is NOT the way to go, then you should alter the transforms stanza like so;

[FilterWinSecurityLogs]
SOURCE_KEY = sourcetype
REGEX = .*WinEventLog.*
DEST_KEY = queue
FORMAT = nullQueue

Hope this helps,

Kristian

timmy13 — Thu, 14 Jun 2012 17:17:50 GMT

No, I do not wish to disable monitoring as we still need application logs from this server. I'll give your suggest a shot, thanks.

kristian_kolb — Thu, 14 Jun 2012 17:24:41 GMT

Well, I didn't mean that you should disable ALL monitoring, just the WinEventLog stuff.

Just find your inputs.conf and add disabled=1 to the WinEventLog stanza(s).

timmy13 — Fri, 15 Jun 2012 15:08:48 GMT

That would disable it across all windows servers. I just need it for ONE server. My transforms currently looks like this but is not working

[FilterAllWMILogs]
SOURCE_KEY = sourcetype
REGEX = .*WMI*
DEST_KEY = queue
FORMAT = nullQueue

kristian_kolb — Sun, 17 Jun 2012 17:29:27 GMT

Are you using the Deployment Server, and have all input configurations in the same deployed app?

kristian_kolb — Sun, 17 Jun 2012 20:11:04 GMT

Hm. that SHOULD work, even if I would say that the REGEX should be;

REGEX = .xWMI.x

Where the x's above are asterisks. sorry about the formatting.

Are you referencing it correctly from props.conf (I saw you had changed the name of the transforms stanza).

I haven't used this type of transform myself, but I don't see why this should pose any real problems.

timmy13 — Mon, 28 Sep 2020 11:57:23 GMT

`props.conf:

[host::myserver]
TRANSFORMS-winlogs = FilterAllWMILogs

transforms.conf:

[FilterAllWMILogs]
SOURCE_KEY = sourcetype
REGEX = .*WMI*
DEST_KEY = queue
FORMAT = nullQueue`