Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

winevtlog input - message field extraction is redundant, resource-intensive and error-prone - please add option to disable it #9568

Open
soc-team-members opened this issue Nov 8, 2024 · 0 comments

Comments

@soc-team-members
Copy link

Is your feature request related to a problem? Please describe.
The winevtlog input always extracts both "System" and "Message" fields.
"System" already contains all the information of the event.
"Message" just contains 100% redundant information in another representation.
The duplicate field extraction costs additional CPU and memory usage without providing any real benefit.
Also, the "Message" extraction is error-prone and not ready for production.
(Even the extraction of the computer name in the event often fails, extracting random characters.)

Describe the solution you'd like
Please add a configuration option to disable the "Message" extraction or to toggle between "System" and "Message", like:
extract_fields: System

Describe alternatives you've considered
Using winlog input instead of winevtlog input is not an option, because winlog does not support queries and is not capable of accessing non-basic Windows Eventlog channels apart form "System/Application/Security".

Additional context
Fluent-Bit 3.1.9

inputs:

- name: winevtlog
  tag: XmlWinEventLog
  alias: WIndows alias
  channels: ForwardedEvents
  interval_sec: 1
  read_existing_events: true
  db: .\checkpoint.db
  render_event_as_xml: true
  string_inserts: false
  read_limit_per_cycle: 2m
  event_query: |
    <QueryList>
      <Query Id='0'>
        <Select Path="ForwardedEvents">*</Select>
      </Query>
    </QueryList>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant