You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
The winevtlog input always extracts both "System" and "Message" fields.
"System" already contains all the information of the event.
"Message" just contains 100% redundant information in another representation.
The duplicate field extraction costs additional CPU and memory usage without providing any real benefit.
Also, the "Message" extraction is error-prone and not ready for production.
(Even the extraction of the computer name in the event often fails, extracting random characters.)
Describe the solution you'd like
Please add a configuration option to disable the "Message" extraction or to toggle between "System" and "Message", like:
extract_fields: System
Describe alternatives you've considered
Using winlog input instead of winevtlog input is not an option, because winlog does not support queries and is not capable of accessing non-basic Windows Eventlog channels apart form "System/Application/Security".
Is your feature request related to a problem? Please describe.
The winevtlog input always extracts both "System" and "Message" fields.
"System" already contains all the information of the event.
"Message" just contains 100% redundant information in another representation.
The duplicate field extraction costs additional CPU and memory usage without providing any real benefit.
Also, the "Message" extraction is error-prone and not ready for production.
(Even the extraction of the computer name in the event often fails, extracting random characters.)
Describe the solution you'd like
Please add a configuration option to disable the "Message" extraction or to toggle between "System" and "Message", like:
extract_fields: System
Describe alternatives you've considered
Using winlog input instead of winevtlog input is not an option, because winlog does not support queries and is not capable of accessing non-basic Windows Eventlog channels apart form "System/Application/Security".
Additional context
Fluent-Bit 3.1.9
inputs:
The text was updated successfully, but these errors were encountered: