Whitelisting windows eventlog for event code 4662 in inputs.conf?

[somdatta1001]

[WinEventLog:Security]

disabled = 0

index= win*

blacklist1=EventCode="4662" Message=”Accesses:\t\t+(?!Create\sChild)”

Is this correct way to filter out event which only have "Create Child" as field value under access?

Please let me know if there is any syntax error or any other solution that I can try.

[richgalloway]

If you're looking for specific text in an event, don't use a negative lookahead for that text as that will find events without the specified text.  Also, it's not clear if the white space in the event is tabs, spaces, or both so it's better to use \s than \t.    Try these settings.

[WinEventLog:Security]
disabled = 0
index= win*
blacklist1=EventCode="4662" Message=”Accesses:\s+Create\sChild"