topic inputs.conf Blacklist Query in Getting Data In

inputs.conf Blacklist Query

kevinmorley — Tue, 21 Apr 2020 13:12:00 GMT

Hi - I'm struggling with the syntax of this blacklist expression and would much appreciate some guidance from anybody that can help. What I'd like to do is blacklist all events other than EventCode=4740 which match the pattern Message=AccountName: *$".

I've been trying variations on the following expression without much success:
blacklist1 = EventCode="(?!4740)" Message="Account Name:[\s+](.\$)"

The 'Message' expression works fine - it's the 'EventCode' negative lookahead clause that I'm struggling with:

Thanks in advance for any suggestions you can provide.

Re: inputs.conf Blacklist Query

richgalloway — Tue, 21 Apr 2020 13:38:07 GMT

Please clarify. Do you want to see only event 4740 with AccountName=* or event 4740 with AccountName!="*$"?
Have you considered a whitelist?

Re: inputs.conf Blacklist Query

kevinmorley — Tue, 21 Apr 2020 13:46:47 GMT

I want to exclude all events except for 4740 which match the pattern Message="Account Name: *$".
By way of example
Include: EventCode="4740" Message="Account Name: computer1$"
Exclude: EventCode="4652" Message="Account Name: computer1$"

I think that a whitelist would have a similar issue as it would require a negative lookahead in the 'Message' clause - but please do feel free to correct me if I'm mistaken.