Regex for source AND Type

schnibitz · ‎07-24-2013

Hi everyone, Been trying to get regex syntax to behave. What I have below works. It only shows events that are from the source "EMET".

props.conf

[WMI:WinEventLog:Application]
TRANSFORMS-wmi=wminull,wmiparse

transforms.conf

[wmiparse]
REGEX=(?m)^SourceName=(EMET)
DEST_KEY=queue
FORMAT=indexQueue

I'm trying to get it to find EMET source events that are also Error logs.

props.conf

[WMI:WinEventLog:Application]
TRANSFORMS-wmi=wminull,wmiparse

transforms.conf

[wmiparse]
REGEX=(?m)^SourceName=(EMET).*^Type=Error
DEST_KEY=queue
FORMAT=indexQueue

But that doesn't seem to work. Any ideas?

Thanks,
-S

samjack · ‎07-27-2013

I would use eventtyping for which events are errors.