Impossible to filter Windows logs by EventID using grep filter

[qmonitoring]

Bug Report

Describe the bug It is impossible to filter Windows logs by EventID using grep filter.

To Reproduce Simple configuration to reproduce the issue:

[INPUT]
    Name               winlog
    Channels           Windows PowerShell
    Tag                win
    Interval_Sec       1
    
[FILTER]
    Name              grep
    Match             win
    Exclude           EventID 800    

[OUTPUT]
    Name              file
    Match             win
    Path              .\logs\

Expected behavior Successful filtering by EventID using grep filter.

Your Environment OS: Win 10 Pro 10.0.19041 FluentBit: fluent-bit-2.0.9-win64

Additional context Related issue: https://github.com/fluent/fluent-bit/issues/6284

[patrick-stephens]

This comes up fairly often I think - the issue is that grep requires a string field but event ID is numeric. The workaround is to convert the event ID to a string (e.g. via a LUA filter).

Initially I think we should at least update the docs section for grep to add a faq for it: https://github.com/fluent/fluent-bit-docs/blob/master/pipeline/filters/grep.md

@qmonitoring if you can please submit a PR for the docs change and I can review/merge?

[leonardo-albertovich]

I'm not sure if it's not documented because it's been deprecated or just because it's missing but we have the type_converter filter which accepts the following settings :

• int_key
• uint_key
• float_key
• str_key

And all of them follow the same pattern (eg. uint_key EventID event_id string) which means you need to specify the source member name, the destination member name and the desired data type.

I'd take it with a pinch of salt but at least I'd give it a try.

[nokute78]

This is a document about type_converter. https://github.com/fluent/fluent-bit-docs/blob/master/pipeline/filters/type-converter.md

However it is missing on https://docs.fluentbit.io/manual/pipeline/filters ...

[cosmo0920]

I implemented a different approach to filter unnecessary events when consuming events with in_winevtlog plugin: https://github.com/fluent/fluent-bit/pull/7848

[umpa385]

Same issue here I've tried a ton of things from modify to grep and even trying to use strings in the message. I just think that the winlog source can't use an additional filter it seems.

[umpa385]

I found a fix for the issue atleast for myself.

here is an example

[Filter] name grep match * Exclude Message /enter regex here/