Windows xml and non-xml format difference- Am I getting duplicate raw event?

[FJOMAA]

Hello,

i'm currently ingesting XML and non-xml windows event logs,

i wanna know the impact if i disable the render xml in my UF,

i wanna know also if i'am getting duplicated raw event if im rendering xml data (non-xml and xml are being ingested together ? )

if the answer is yes and if i disable the xml format do i get some data loss ? (because i get some event id that being ingested only in xml format).

[richgalloway]

AIUI, events will be sent in either XML or non-XML format, but not both.  If you disable XML then the event will be sent in non-XML format.  If you disable the input then events will not be sent at all (data loss).