Windows eventlog input plugin (based on #7020)#8000
Merged
ssoroka merged 13 commits intoinfluxdata:masterfrom Sep 28, 2020
simnv:win_eventlog
Merged
Windows eventlog input plugin (based on #7020)#8000ssoroka merged 13 commits intoinfluxdata:masterfrom simnv:win_eventlog
ssoroka merged 13 commits intoinfluxdata:masterfrom
simnv:win_eventlog
Conversation
1. Keywords are converted from hex uint64 to text, and added as tag 2. Additional tags and fields: computer, version, task, opcode, activity_id, user_id, process_id, process_name, thread_id 3. user_id, activity_id, opcode are added only if not empty 4. process_name is derived from pid 5. Event Data values are added by its names from Name attributes 6. Non-default Locale setting for converting Keywords to Text 7. Updated documentation
This was referenced Aug 18, 2020
Contributor
Author
|
Some ideas in library used in #7989 were very interesting, so I've changed code of this plugin a bit:
|
1. Full list of System fields, also Level, Task and Opcode are rendered to text with given local 2. Message is rendered with given locale, also you can get only first line of Message 3. Username is rendered from UserID SID 4. Event fields filtering: you can now select which fields to use as tags, which fields to exclude, and which fields to exclude only if they are empty 5. Globbing is supported for all those filters 6. Added some tests for filtering logic 7. UserData and EventData processing is now optional, also xml field naming changed a bit 8. XML Field names Separator is now configurable 9. Some small fixes for typos
Contributor
|
Thanks @simnv for the PR! Simnv is available on the InfluxDB community slack if we have questions about this PR. |
p-zak
reviewed
Sep 22, 2020
1. If evtSubscribe fails, return error instead of continuing to try with empty handle. 2. Check xml.Unmarshal for err, also add more error handling in tests. 3. Fix utf16 variable name that collided with imported package name. 4. Remove unused consts EvtRenderEventValues, EvtFormatMessageChannel, EvtFormatMessageProvider, EvtFormatMessageId and EvtFormatMessageXml
Contributor
Author
|
@p-zak Thank you for the review! I think I've addressed all of your notes in a new commits. Ready to discuss more. :) |
p-zak
reviewed
Sep 23, 2020
Collaborator
|
@simnv I think you can resolve all previous issues - LGTM :) |
ssoroka
approved these changes
Sep 28, 2020
arstercz
pushed a commit
to arstercz/telegraf
that referenced
this pull request
Mar 5, 2023
…8000) Co-authored-by: Anuar Serdaliyev <serdaliyev.anuar@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Got win_eventlog pull request #7020 from @anuar45 for feature #4525 and went further (keeping his commits in this PR too):
computer, version, task, opcode, activity_id, user_id, process_id,
process_name, thread_id