event viewer - Issue selecting specific levels of windows application logs in NXLog -
i'm trying pass warning / error / critical level application logs through nxlog elk stack. when have configuration
<input eventlog_in> module im_msvistalog # kinda works me, put * query <querylist>\ <query id="0">\ <select path="application">*</select>\ </query>\ </querylist> exec to_json(); </input>
everything works fine, , i'm collecting levels of application logs. tried putting in parameter on <select path>
line
<select path="application">*[application/level=1]</select>\
and craps , nothing. nxlog isn't reporting issue, , i'm not seeing on logstash side of things.
i got information event viewer querying thread , adapted use case: https://serverfault.com/questions/543494/query-specific-logs-from-event-log-using-nxlog
figured out. apparently reference error level isn't application, it's system. query looks , works flawlessly
<select path="application">*[system[(level=1 or level=2 or level=3)]]</select>\
i'm using windows server 2008 r2, fwiw.
Comments
Post a Comment