How can I disable a windows event id from indexing?

[troywjonescc]

I have an event id 4674 that I would like to block from being indexed.  I have the following in my in inputs.conf in local not default.

[WinEventLog://Security]

disabled = true

blacklist1 = EventCode = "4764" Message="*"

[troywjonescc]

Do I need to add those lines to the props.conf as well?  Where do I put that deny list at?

[richgalloway]

Use my example blacklist1 setting as a replacement for the one in the OP.  Make sure the props.conf file is installed on the Windows UFs.

[richgalloway]

The input stanza is disabled so there should be no Security events coming in.  If you're still getting them then it could be because: 1) the inputs.conf is not loaded on the right instance (UF); 2) the instance was not restarted after props.conf was modified; or 3) the event is not a Security event.

Also, try specifying the EventCode alone in the deny list.

blacklist1 = 4764