I guess we are not the only ones using Forwarding of WinEvents to a central server with an indexer. Does anyone else do it and use the windows infrstructure app?
We forward events and thus source and sourcetype is WinEventLog:ForwardedEvents
I guess we should override source and sourcetype based on the value in LogName. Has anyone done this and could you provide the necessary transforms? (could it be included in the app or a small TA companion for it?)
Better late than never. I believe this should be sufficient:
[Set-Host-By-ComputerName] REGEX = (?m)ComputerName=(.*)?\b FORMAT = host::$1 DEST_KEY = MetaData:Host [Set-Sourcetype-By-LogName] REGEX = (?m)LogName=(.*)?\b FORMAT = sourcetype::WinEventLog:$1 DEST_KEY = MetaData:Sourcetype
[WinEventLog:ForwardedEvents] TRANSFORMS-001-sethost_sourcetype = Set-Host-By-ComputerName, Set-Sourcetype-By-LogName
This retains the source value of WinEventLog:ForwardedEvents. You may have to override this too 🙂
[WinEventLog://ForwardedEvents] sourcetype=WinEventLog:ForwardedEvents disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 index = windows renderXml=false
Isn't WRITE_META = true needed when modifying these kinds of values in transforms?
Additionally, the "source" field is very important in windows event logs, so shouldn't there also be a transform for that here?
The props configuration should also reference the source rather than sourcetype to better work with version 5 and up of the Windows TA.
I know this question is coming up on a year old but mikaelbje, you are the MAN. I was in a pickle at a customer site with a stupid WEC server. This was PERFECT! Thanks for the awesome solution!