One event per file will likely have you end up with millions of files and might cause trouble with too much connections, files etc... Do you need to collect ALL windows events for that or only a tiny subset?

This has been discussed before. Very difficult to achieve and I would strongly recommend against it.https://cribl-community.slack.com/archives/CPYBPK65V/p1661282080042919

Yeah, I also see that this is not a good option. I'm going to check with Hunters if there is some other better alternative.

Thanks for the quick feedback guys!!