Hello! I am trying to collect 3 additional Windows Event logs and I have added them in the inputs.conf, for example [WinEventLog://Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provid...
See more...
Hello! I am trying to collect 3 additional Windows Event logs and I have added them in the inputs.conf, for example [WinEventLog://Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
renderXml=true Admin, Autopilot, and Operational, were added the same way. I also added in props.conf [WinEventLog:Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin]
rename = wineventlog
[WinEventLog:Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Autopilot]
rename = wineventlog
[WinEventLog:Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational]
rename = wineventlog The data are coming in, however, none of the fields are parsed as interesting fields. Is there something I am missing? I looked through some of the other conf file, but I think I am in over my head to make a new section in props? I thought the base [WinEventLog] would take care of the basic breaking up of interesting fields like EventID, so I am a bit lost.