Hello,
Is it possible to add a custom source override to a windows eventlog in the inputs.conf stanza?
Doesn't look like it according to inputs.conf, but you could always use an index-time transform.
