## This is YAML, so structure and indentation is important.
## Lines can be uncommented by removing the #. You should not need to change the number of spaces after that.
## Config options have a single #, comments have a ##. Only uncomment the single # lines if you need them.
#####

sources:
  windowsEvents:
    type: wineventlog
    sink: logscaleSink
    channels:
      # Collect all from ForwardedEvents except EventID 900 and 903
      - name: ForwardedEvents
        excludeEventIDs: [900, 903]
      # Collect EventID's 4624, 4634 and 4672 from Security
      - name: Security
        onlyEventIDs: [4624, 4634, 4672]
      # Collect all events from System/Microsoft-Windows-NLB with level 1 and 2
      - name: System
        providers:
         - "Microsoft-Windows-NLB"
        levels: [1, 2]
      # Collect from Application using a XPath query
      - name: Application
        type: query
        query: *[System[Level<4] and System/Provider[@Name="Microsoft-Windows-Security-SPP"]]
      # Collect using cross-channel querying
      - name: CustomQueryXML
        type: query
        query: |
          <QueryList>
            <Query>
              <Select Path="Application">
                *[System[Level>0] and System/Provider[@Name="Microsoft-Windows-Security-SPP"]]
              </Select>
              <Suppress Path="Application">
                *[System[EventID=1004]]
              </Suppress>
            </Query>
          </QueryList>

    ## You can manually specify a parser to be used here.
    parser: microsoft-winevent

    transforms:
      - type: static_fields
        fields:
          role: "firewall"

    ## Set language to en-US
    language: 1033

    ## Overwrite default behaviour to exclude raw XML
    format: renderFieldsOnly

sinks:
  logscaleSink:
    type: logscale
    token: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
    ## Replace with the "Ingest URL" on the FLC download page. It must include the "https://" at the beginning.
    url: https://your.logscale.cluster