Update required of a specific windows EventID

View thread

dudu.confirm@gmail.com

Hi, 

Doing my first steps with NXlog.

I have managed to collect all “Security” windows event log and also managed to update the “Version” parameter to my own parameter - Just for a test purposes 

Now I need to perform 3 tasks 

  1. Collect all “Security” windows event log - Done
  2. Update the “Version” parameter from int to string - Done 
  3. Update the “Hostname” parameter of specific event ID (for example EventID":4656) to “test”  - Please advice 

Thank you 

<Input eventlog>   Module  im_msvistalog   <QueryXML>       <QueryList>           <Query Id='0'>    <Select Path='Security'>*</Select>           </Query>       </QueryList>   </QueryXML><Exec>       $Hostname = "test" ;      # This task should be only for eventID 4656       $Version = string($Version);       to_json();   </Exec></Input>