Why do I see events for Windows event codes other than what is wanted with my current configuration?

[MikeBertelsen]

I am getting back event codes (6013, 7002, 7036, 7040), but none for 1025 which is the only one I expected to find.
In the deployment-apps directory, I have a configuration that contains the following stanzas:

OS Logs

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 1
evt_resolve_ad_obj = 1
checkpointInterval = 5
whitelist1 = EventCode="1025" Message="Object Type:\s+(?!groupPolicyContainer)"
index = wineventlog_ivr
renderXml=false

[WinEventLog://System]
disabled = 0
start_from = oldest
current_only = 1
checkpointInterval = 5
whitelist1 = EventCode="1025" Message="Object Type:\s+(?!groupPolicyContainer)"
index = wineventlog_ivr
renderXml=false

###### Scripted Input (See also wmi.conf)
[script://$SPLUNK_HOME\etc\apps\Splunk_TA_windows\bin\win_listening_ports.bat]
disabled = 0
## Run once per hour
interval = 3600
sourcetype = Script:ListeningPorts
index = windows

[MikeBertelsen · Accepted solution]

The stanzas are fine. It is a requirements issue. I needed:
[WinEventLog://Application]
disabled = 0
start_from = oldest
current_only = 1
evt_resolve_ad_obj = 1
checkpointInterval = 5
whitelist = 1025
whitelist1 = Message="Object Type:s+(?!groupPolicyContainer)"
index = wineventlog_ivr
renderXml=false

[mgildenhorn_spl]

Have you first tried the built in event id filtering? You also might want to remove the Message key first just to make sure the filtering works by itself.

Format would be: whitelist = 1025

So in your security logs example:

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 1
evt_resolve_ad_obj = 1
checkpointInterval = 5
whitelist = 1025
index = wineventlog_ivr
renderXml=false

Then if that works, you can add back the Message filter:

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 1
evt_resolve_ad_obj = 1
checkpointInterval = 5
whitelist = 1025
whitelist1 = Message="Object Type:\s+(?!groupPolicyContainer)"
index = wineventlog_ivr
renderXml=false