fluent-plugin-parser-winevt_xml

Test on macOS Test on Ubuntu Test on Windows

Component

Fluentd Parser plugin for XML rendered Windows EventLogs

Fluentd plugin to parse XML rendered Windows Event Logs.

Installation

gem install fluent-plugin-parser-winevt_xml

Configuration

parser_winevt_xml

<parse>
  @type winevt_xml
  preserve_qualifiers true
</parse>

preserve_qualifiers

Preserve Qualifiers key instead of calculating actual EventID with Qualifiers. Default is true.

parser_winevt_sax

This plugin is a bit faster than winevt_xml.

<parse>
  @type winevt_sax
  preserve_qualifiers true
</parse>

preserve_qualifiers

Preserve Qualifiers key instead of calculating actual EventID with Qualifiers. Default is true.

Copyright(C) 2019- Hiroshi Hatake, Masahiro Nakagawa

License

Apache License, Version 2.0