Hi All, My inputs conf are as follows [WinEventLog://Application] disabled = 0 whitelist = EventCode="26|25|19" whitelist1 = SourceName="DWMRCS" index = wineventlog evt_resolve_ad_obj = 0 checkpointInterval = 5 Result : Getting all events which include 26 ,25,19 i.e. 326,1026,1025,10025,259,258, and more. I also tried [WinEventLog://Application] disabled = 0 whitelist = EventCode="^26$|^25$|^19$" whitelist1 = SourceName="DWMRCS" index = wineventlog evt_resolve_ad_obj = 0 checkpointInterval = 5 But same results. Thanks In Advance ... View more