cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Log Ingest

Pabloabad
Frequent Guest

Good morning,
I have activated the option to ingest the logs from the wiondows event viewer, but I would like to ingest only the logs that come from a specific "winlog.provider".
Is it possible to do this and not ingest the rest? or should I always filter from logs and events to be able to see it?

6 REPLIES 6

Thanks for the answer.

But actually is harder for us to filter out all the logs that we don't want than filter in the ones that we want.

Is it posible to make a rule to filter only the logs we want?

Create a processing rule like 

matcher

log.source="Windows Application Log" AND winlog.provider!=".Net Runtime" AND dt.entity.process_group_instance="XXXXXXX"

process definition 

FILTER_OUT(true)

move it to the last rule

Hopefully it will work for you

 

 

Still get this response in DQL Query

Try Without matchesvalues. Are you using classic logs?

Eric_Yu
Dynatrace Mentor
Dynatrace Mentor

Seems like there isn't a filter for winlog.provider, but a workaround could be to use another property that you've identified that only comes with logs that come from that provider.

My first thought would be to use the log content with wildcards for matching:

Eric_Yu_0-1718898015131.png

However, you can try other attribute that makes more sense to you. Hope it helps.

Eric Yu | LATAM ACE Consultant

Featured Posts