Blacklist format

[sswigart]

-- I want to see events of 4648. I want to filter out certain ones. Is my stanza configured correctly?

\etc\system\local\inputs.conf

[WinEventLog://Security]
disabled = 0

whitelist = EventCode="4648"

blacklist = EventCode="4648" Message="Account\sWhose\sCredential\sWere\sUsed:\sAccount\sName:\s+computer01$"
blacklist = EventCode="4648" Message="Account\sWhose\sCredential\sWere\sUsed:\sAccount\sName:\s+Window Manger"
blacklist = EventCode="4648" Message="Account\sWhose\sCredential\sWere\sUsed:\sAccount\sName:\s+Font Driver Host"

-- Is there a Log that I can look at to troubleshoot my stanza?