im_msevent keywords datatype wrong


#1 tobias42

Hi everybody,

while experimenting with nxlog and relaying windows event logs I stumbled over the issue that even in the latest versions the

field Keywords from the Window log is defined in ms_msevent as integer which doesn't fit the values stored in the field in windows.

Are there any plans to fix this?

best regards

Tobias

 

#2 b0ti Nxlog ✓
#1 tobias42
Hi everybody, while experimenting with nxlog and relaying windows event logs I stumbled over the issue that even in the latest versions the field Keywords from the Window log is defined in ms_msevent as integer which doesn't fit the values stored in the field in windows. Are there any plans to fix this? best regards Tobias  

Yeah, this is in the queue. I suppose it's best to capture it as a string instead.