I know this is old but I was hung up on the differences in syntax. Looks like hyper-v event logs don't use the commonly used forward slash but uses a dash instead. Example: Microsoft-Windows-Hyper-V-Hypervisor/Operational Microsoft-Windows-Hyper-V-Hypervisor/Admin VS Microsoft-Windows-Hyper-V-Hypervisor-Operational Microsoft-Windows-Hyper-V-Hypervisor-Admin This stanza works for me. I am using a universal forwarder on a remote machine. [WinEventLog://Microsoft-Windows-Hyper-V-Hypervisor-Operational] disabled = 0 Also, make sure there are actual event entries in the Admin; mine was zero and took me a minute to figure that one out. ... View more