Regresar
-
Título
WEC: EventID has inconsistent JSON output. -
Descripción
For wec input, we’re experiencing an issue where EventID has inconsistent JSON output. In most cases, EventID looks normal, e.g. "EventID":"4672", however, for 7036 events (and some others), it has nested data: "EventID":{"_Qualifiers":"16384","EventID":"7036"}. The agent version appears to have no problems with 7036 Events: "EventID":"7036" Is there a way to get EventID into a consistent data type using WEC? -
Resolución
The windowsevent-parser() only does a translation of XML data structures to macros in a slavish way, so if there are child nodes of the EventID XML tag, then they will be reflected in the macros of syslog-ng.This problem could be overcome by using this rewrite rule:rewrite r_fix_eventid {set("${.win.Event.System.EventID.EventID}", value("EVENT_ID") condition("${.win.Event.System.EventID.EventID}" ne "");set("${.win.Event.System.EventID}", value("EVENT_ID") condition("${.win.Event.System.EventID.EventID}" eq ""); };