OS:Windows server 2016
NXlog:CE-2.10.2150

I want to filter the Windows event log message string ("Test_Message"). ..
It doesn't work. Please tell me what's wrong

[nxlog.conf]
```
Panic Soft
#NoFreeOnExit TRUE

define ROOT C:\Program Files (x86)\nxlog
define CERTDIR %ROOT%\cert
define CONFDIR %ROOT%\conf
define LOGDIR %ROOT%\data
define LOGFILE %LOGDIR%\nxlog.log
LogFile %LOGFILE%

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data

<Extension _syslog>
Module xm_syslog
</Extension>


<Extension charconv>
Module xm_charconv
AutodetectCharsets shift_jis, utf-8
</Extension>

###################################
# define input
###################################
define SystemError 10016, 10028, 36882

<Input in_eventlog>
Module im_msvistalog
<QueryXML>
<QueryList>
<Query Id="0" Path="Application">
<Select Path="Application">*[System[(Level=1 or Level=2)]]</Select>
</Query>
</QueryList>
</QueryXML>

<Exec>
if ($EventID IN (%SystemError%) and
($Data == ’Test_Message’)
) drop();
</Exec>
Exec convert_fields("shift_jis", "utf-8");
</Input>
###################################
# difine output
###################################
<Output out_eventlog>
Module om_udp
Host **********
Port 514
</Output>

###################################
# Route monitor
###################################
<Route route>
Path in_eventlog => out_eventlog
</Route>
```

[Windows Eventlog]※XML
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="EventLog" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>1</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2020-09-09T01:41:53.762804400Z" />
<EventRecordID>16834</EventRecordID>
<Channel>System</Channel>
<Computer>sv-otebk.ads.nttdata.co.jp</Computer>
<Security />
</System>
- <EventData>
<Data>Test_Message</Data>
</EventData>
</Event>

Hello,

Seems your <Data> in <EventData> has bad structure - no field name is provided. For list of supported by im_msvistalog fields, please refer to https://nxlog.co/docs/nxlog-ce/nxlog-reference-manual.html#im_msvistalog_fields

Regards,

Rafal