event log - nxlog querylist doesn't work as expected -


nxlog.conf

the above link copy of nxlog.conf. couldn't find documentation how use multiple blocks within querylist block, based on name assumed able this. elk server receiving events right now, not of filtered ones. wanted use 1 query block limited 10 select entries. can't find examples of people using more 3 select entries. has had luck more advance nxlog.conf's? appreciated.

not sure issue query xml is. if there limitation on number of select entries, that's coming windows eventlog api cannot helped.

on other hand can use nxlog's native filtering using drop():

query       <querylist>\                 <query id="0">\                     <select path="security">*</select>\                 </query>\             </querylist> exec if not ($eventid == 1 or $eventid == 2 or ...) drop(); 

Comments

Popular posts from this blog

php - failed to open stream: HTTP request failed! HTTP/1.0 400 Bad Request -

java - How to filter a backspace keyboard input -

java - Show Soft Keyboard when EditText Appears -