0

I want to upload events only from a "puppet" source, which is "Windows Logs\Application". I guess I have to change the line <Select Path = 'Application'> * </Select>

How to filter source "puppet" in nxlog.conf?

<Input in>
    Module       im_msvistalog
    ReadFromLast TRUE
    <QueryXML>
       <QueryList>
         <Query Id='1'>
           <Select Path='Application'>*</Select>      
         </Query>
       </QueryList>
   </QueryXML>
   Exec $FileName = 'winapp.log';
   Exec $EventTime = $EventReceivedTime;   
 </Input>

<Output out1>
 Module om_udp
 Host 10.10.0.40
 Port 514
 Exec to_syslog_bsd();
</Output>

<Route 1>
Path in => out1
</Route>
Mr. NoNe
  • 53
  • 1
  • 8

1 Answers1

1

here's how i've done it :

<Query Id='1'>
    <Select Path="Application">*[System[Provider[(@Name="MySrcName")]]]</Select>
</Query>

I found the tree path : System > Provider > Name by opening the windows event viewer, then select your event, then event properties, then details.

I said that because it may be different for you based on your windows version.

Chtioui Malek
  • 11,197
  • 1
  • 72
  • 69