For people has the same requirement. props.conf [WMI:WinEventLog:Security] TRANSFORMS-set= setnull,setparsing,nulladm transforms.conf [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX =(?msi)^EventCode=4663 DEST_KEY = queue FORMAT = indexQueue [nulladm] REGEX =(?msi).Account\\sName:\\s+Administrator DEST_KEY = queue FORMAT = nullQueue ... View more