event viewer - Issue selecting specific levels of windows application logs in NXLog -


i'm trying pass warning / error / critical level application logs through nxlog elk stack. when have configuration

<input eventlog_in> module im_msvistalog # kinda works me, put * query <querylist>\ <query id="0">\ <select path="application">*</select>\ </query>\ </querylist> exec to_json(); </input>

everything works fine, , i'm collecting levels of application logs. tried putting in parameter on <select path> line

<select path="application">*[application/level=1]</select>\

and craps , nothing. nxlog isn't reporting issue, , i'm not seeing on logstash side of things.

i got information event viewer querying thread , adapted use case: https://serverfault.com/questions/543494/query-specific-logs-from-event-log-using-nxlog

figured out. apparently reference error level isn't application, it's system. query looks , works flawlessly

<select path="application">*[system[(level=1 or level=2 or level=3)]]</select>\

i'm using windows server 2008 r2, fwiw.


Comments

Popular posts from this blog

php - Invalid Cofiguration - yii\base\InvalidConfigException - Yii2 -

How to show in django cms breadcrumbs full path? -

ruby on rails - npm error: tunneling socket could not be established, cause=connect ETIMEDOUT -