@PickleRick thanks, I think that's done it, I've changed the message part of the blacklist with that bit of regex you suggested, and have it working now. Now I can get round to some fine tuning. As a side note, to anyone who might come across this: My original (non working) text didn't contain a ":" as it was used in the source message. Once I corrected it to match, it started working. So it turned out as: blacklist4 = EventCode="5152" Message="Protocol:\s*17" ... View more

@PickleRick thanks for responding, however reading those docs are confusing as hell, and I feel like I know even less now. Could you possible dumb it down (even further) for me? I have RenderXml set to "False" This is the part of my "inputs.conf" I'm looking at, specifically the "blacklist4" line is causing major frustration: [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 key=*regex* blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)" blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)" blacklist3 = 4624,4634,4648,4719,4798,4799,5379,5381,5382,4985,4663,4672 blacklist4 = EventCode="5152" Message="Protocol = 17" renderXml = false I've already tried a bunch of different formatting for the message part. As soon as I omit it, the events are blocked, but I can't get that filter to do what I want. ... View more