Hi Amar, Both options should work. Note that in your email you are talking about the 'Application' log whereas your Query XML has 'System'.
If you create a filter in event viewer and click on the XML tab, that XML can be copied to the Query directive, just make sure to add a backslash after each line. See here: http://blogs.technet.com/b/kfalde/archive/2014/03/25/xpath-event-log-filtering.aspx Regards, Botond On Tue, 20 Oct 2015 08:29:17 -0700 Amar Johal <a...@loggly.com> wrote: > Hello, > > We have an app on a server that writes out to the Application log. we can > set a custom view for this using the “Event sources” field in the Event > Viewer. > > I am hoping I can use the nxlog configuration to push only that event > source up. > > Is this possible? > > I tried the below 2 options but to no avail: > > Within the input module, include this: > > Exec if $SourceName != 'ENTER SOURCE NAME' drop(); > > and also: > > <Input in> > Module im_msvistalog > Query <QueryList> \ > <Query Id="0"> \ > <Select Path="System">*[System[Provider[@Name='ENTER SOURCE > NAME']]]</Select> \ > </Query> \ > </QueryList> > </Input> ------------------------------------------------------------------------------ _______________________________________________ nxlog-ce-users mailing list nxlog-ce-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users
