I am trying to filter out noise before it is sent to the indexer. We were using Windows Event Forwarding previously, that was able to filter but now I am trying to create the same filter. I am modifying inputs.conf on the server running a Universal Forwarder.
So, we are trying to filter out:
Event ID = 4688
SubjectLogonId = 0x3e7 (the local system account)
AND a list of processes that includes the full path, for example:
The Universal Forwarder (UF) does not have the ability to filter data. Only heavy forwarders (HF) and indexers can do that. If you're set on not sending the events to your indexers then replace the UF with a HF. You'll probably get better performance, however, by keeping the UF and doing the filtering on the indexers (at the expense of network traffic, of course).
That said, your proposed blacklist will not work because it uses keys that are not supported in blacklists. Supported keys are: Category, CategoryString, ComputerName, EventCode, EventType, Keywords, LogName, Message, OpCode, RecordNumber, Sid, SidType, SourceName, TaskCategory, Type, User.
--- If this reply helps you, an upvote would be appreciated.