topic Re: Log ingestion windows event viewer in Log Analytics

Log ingestion windows event viewer

Berry — Tue, 18 Aug 2026 04:22:39 GMT

hi guys,

just wondering if we could ingest everything under windows viewer that includes all the subfolder?

i understand we need to specify the path, but there's too many. can we have a wildcard that it will ingest everything?

Appreciate your input 🙂

thank you!

Re: Log ingestion windows event viewer

AntonPineiro — Tue, 18 Aug 2026 07:42:33 GMT

Hi,

You can enable this built-in ingestion rule:

It will be applied in all Windows hosts.

Best regards

Re: Log ingestion windows event viewer

Berry — Tue, 18 Aug 2026 07:52:15 GMT

hi @AntonPineiro ,

thank you for your swift respond. i understand this will ingest windows system,application and security. do you have any advise if we want to enable it all instead?

Re: Log ingestion windows event viewer

AntonPineiro — Tue, 18 Aug 2026 13:23:40 GMT

Hi,

Since you pay for every data ingested, I do not like ingest everything normally.

I would try to ingest only that mandatory data filtering by log source + pattern lines matching.

Best regards

Re: Log ingestion windows event viewer

m3tomlins — Tue, 18 Aug 2026 21:37:42 GMT

It should be possible to ingest all those windows events, but I would caution that you might also add some matching dt.security_context to the type of records that you might not want EVERYONE in the tenant to have access.

Like the security events, you might limit access via dt.security_context with a matching IAM Policy.