Windows Event Logs out in XML

View thread

Santiago Sarchetti (Last updated )

Hello, I´m trying to send logs from my windows server to my SIEM in XML format, but same logs are too long and i see 2 logs instead of just one. 

<Input windows>
    Module  im_msvistalog
          <Query Id="0" Path="Security">
           <Select Path="Security">*</Select>
           <Suppress Path="Security">*[System[(EventID=4663 or EventID=4690 or EventID=4658 or EventID=4656)]]</Suppress>
<Output siem>
    Module      om_tcp
    Port        514
    Exec        to_xml();
# Connect input 'in' to output 'out'
<Route 1>
    Path        windows => siem


Can anyone help me?