Skip to main content
Question

is there a way to add a function to drop for windows event logs that are sent via syslog?

  • March 11, 2025
  • 6 replies
  • 22 views

I am new here and don't know where to start or ask this question.But, is there a way to add a function to the pipeline to drop
for windows event logs that are sent via syslog to a separate SIEM that only collects logs via syslog?Below is an example of how the logs are post-processed in syslog.`
Process Information:
Process ID:
`

6 replies

David Maislin

Yep


David Maislin

Use the Mask Function


David Maislin

You might also need `
` and `
` and use the global g and m for multiline flag


David Maislin

I DM'd you.


  • Author
  • Employee
  • March 11, 2025

Thank you, David, can you please elaborate what the \r does?


David Maislin

All fixed with Mask