topic Re: Custom Log Source - Windows Event Log in Log Analytics

Create a Custom Windows Event Log Source in Dynatrace

jegron — Fri, 23 Jan 2026 09:40:59 GMT

Summary: This post describes how to onboard Windows Event Logs as a custom log source in Dynatrace. It walks through required configuration steps, available options, and limitations.

Hello everyone,

I am trying to collect the custom Windows event log file, which is located in this path :

C:\Windows\System32\winevt\Logs\MYLOG.evtx

Following documentation (https://www.dynatrace.com/support/help/observe-and-explore/logs/log-monitoring/acquire-log-data/log-custom-source and https://www.dynatrace.com/support/help/observe-and-explore/logs/log-monitoring/acquire-log-data/log-storage and https://www.dynatrace.com/support/help/observe-and-explore/logs/log-monitoring/acquire-log-data/add-log-files-manually-v2#Windoweventlog) I tried several syntax without success. Ex :

Type : Windows Event Log
Log Source : C:\Windows\System32\winevt\Logs\MYLOG.evtx
Type : Windows Event Log
Log Source : C:\Windows\System32\winevt\Logs\MYLOG
Type : Windows Event Log
Log Source : Windows\System32\winevt\Logs\MYLOG.evtx
Type : Windows Event Log
Log Source : MYLOG.evtx
Type : Log Path
Log Source : C:\Windows\System32\winevt\Logs\MYLOG.evtx

Same for Log storage configuration.

For information, we are using default security rules :

{
"directory-pattern":"/windows/system32/winevt/Logs/",
"file-pattern":"*",
"action":"INCLUDE"
}

Does anyone have the right syntax?

Re: Custom Log Source - Windows Event Log

rgarzon1 — Wed, 14 May 2025 06:20:17 GMT

hi @jegron

The sintaxis seems ok, even with the considerations of the documentation.

But that sintaxis works fine with normal logs or files .log if you are trying to use .evtx you should use the full path according to the documentation

"You can use the built-in Windows Event Viewer to find the custom log name. Make sure that you provide the full path."

windows events

did you allready try that ?

Regards

Re: Custom Log Source - Windows Event Log

jegron — Tue, 11 Apr 2023 12:14:39 GMT

Hi @rgarzon1 !

Finally find the right syntax :

Custom Log Source :
- Source Type : Windows Event Log
- Log Source value : mylog.evtx
Log storage :
- Matcher : Log source
- Value : mylog