Fluentd plugin to parse XML rendered Windows Event Logs.

gem install fluent-plugin-parser-winevt_xml

<parse>
  @type winevt_xml
  preserve_qualifiers true
</parse>

Preserve Qualifiers key instead of calculating actual EventID with Qualifiers. Default is true.

This plugin is a bit faster than winevt_xml.

<parse>
  @type winevt_sax
  preserve_qualifiers true
</parse>

Preserve Qualifiers key instead of calculating actual EventID with Qualifiers. Default is true.

Copyright(C) 2019- Hiroshi Hatake, Masahiro Nakagawa

Apache License, Version 2.0