event log - nxlog querylist doesn't work as expected -
the above link copy of nxlog.conf. couldn't find documentation how use multiple blocks within querylist block, based on name assumed able this. elk server receiving events right now, not of filtered ones. wanted use 1 query block limited 10 select entries. can't find examples of people using more 3 select entries. has had luck more advance nxlog.conf's? appreciated.
not sure issue query xml is. if there limitation on number of select entries, that's coming windows eventlog api cannot helped.
on other hand can use nxlog's native filtering using drop():
query <querylist>\ <query id="0">\ <select path="security">*</select>\ </query>\ </querylist> exec if not ($eventid == 1 or $eventid == 2 or ...) drop();
Comments
Post a Comment