inputs.conf Blacklist Query

[kevinmorley]

Hi - I'm struggling with the syntax of this blacklist expression and would much appreciate some guidance from anybody that can help. What I'd like to do is blacklist all events other than EventCode=4740 which match the pattern Message=AccountName: *$".

I've been trying variations on the following expression without much success:
blacklist1 = EventCode="(?!4740)" Message="Account Name:[\s+](.\$)"

The 'Message' expression works fine - it's the 'EventCode' negative lookahead clause that I'm struggling with:

Thanks in advance for any suggestions you can provide.

[richgalloway]

Please clarify. Do you want to see only event 4740 with AccountName=* or event 4740 with AccountName!="*$"?
Have you considered a whitelist?

[kevinmorley]

I want to exclude all events except for 4740 which match the pattern Message="Account Name: *$".
By way of example
Include: EventCode="4740" Message="Account Name: computer1$"
Exclude: EventCode="4652" Message="Account Name: computer1$"

I think that a whitelist would have a similar issue as it would require a negative lookahead in the 'Message' clause - but please do feel free to correct me if I'm mistaken.