is there a way to add a function to drop for windows event logs that are sent via syslog?

Abby Strong

I am new here and don't know where to start or ask this question. But, is there a way to add a function to the pipeline to drop
for windows event logs that are sent via syslog to a separate SIEM that only collects logs via syslog? Below is an example of how the logs are post-processed in syslog. `
Process Information:
Process ID:
`

David Maislin

Yep

David Maislin

Use the Mask Function

David Maislin

You might also need `
` and `
` and use the global g and m for multiline flag

Abby Strong

Thank you, David, can you please elaborate what the \r does?

David Maislin

I DM'd you.

David Maislin

All fixed with Mask