[WinEventLog://Security]
disabled = 0
host = ABC
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist1 = EventCode="4662" Message="Object Type:\s+(?!groupPolicyContainer)"
blacklist2 = EventCode="566" Message="Object Type:\s+(?!groupPolicyContainer)"
When we are putting this configuration in inputs.conf wherewver we are installing HF then we are seeing its forwarding the old event also.
How we can define to send latest event or 7d event which is monitoring file ?
Can someone please help ?
