I've moved the Windows Event log Forwarded Events log to another partition because I expect it to out grow the C partition on our W2K16 machine. In my input conf, before I moved the log I had it set to the following:
[WinEventLog://ForwardedEvents]
disabled = 0
index = wineventlog
Which seem to work fine, however after moving the evtx file I set up the following in my input conf file and it doesn't seem to work as expected
[monitor://E:\ForwardedEventsLogs\ForwardedEvents.evtx]
sourcetype=WinEventLog:ForwardedEvents
index = wineventlog
disabled = 0
What I get is garbage like this:
ElfFile\x00\x00\x00\x00\x00\x00\x00\x00\x00@!\x00\x00\x00\x00\x00ԏ\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00
Any suggestions on what I'm doing wrong?
Thanks!
