I've read a few posts about ingesting multiple .evt files using the im_msvista module. Is there a way to do this?

I can point to one, but I need to look at several.

thank you!

AskedDecember 10, 2019 - 1:35am

Answer (1)


Unfortunately you can only use one File directive. You could use include_stdout directive to pull in your files as a script though.
Basically your script would need to build an Input instance for each file and output in a for loop, for instance.

Write-Output from PowerShell can do the task.
Something like the following maybe. Has not been tested.

$files = Get-ChildItem 'C:\test\' -Filter *.evt
foreach ($f in $files){
    $fname = $f.FullName
    $name = $f.BaseName
    Write-Output "<Input in_$name>`n    Module    im_msvistalog`n    File    $fname`n</Input>"

Please see the .cmd file in the DHCP Audit log section for how to embed a powershell script in CMD. https://nxlog.co/documentation/nxlog-user-guide/windows-dhcp-server.html#collecting-dhcp-server-audit-logs

You will need to update your Route as well (or let the auto-built route handle it) .

That should work for you