How to create depended item from Windows eventlog filtered by eventid

[Daugava]

Hello.

I'm collecting information from the Application EventLog using

eventlog[Application,,"Warning|Error",,,,skip]

and want to store it for future use.
I 've triggers with a specific EventID=1000 based on this information.

However, I need to do additional log processing to get the information about which application actually caused this event. In my opinion, it is reasonable to first create a Depended Item that would filter the information by EventID=1000, but the functions for this are only available at the trigger level. I do not want to create a separate Item

eventlog[Application,,"Warning|Error",,,1000,skip]

because it will actually double the load on the Zabbix Agents. Is it possible?

[cyber]

ah yeah.. sry.. reading a bit in "diagonal". There is no option to do preprocessing based on EventID.. You can set regex only on that message text..
By creating a separate item, you will definitely not double the agent load.. but as you have already very general catch there, then you will pick up some stuff twice... So some should be excluded from "catch all".

[cyber]

Dependent items are dealt with on server side... Agent just collects initial data, forwards to server and then server splits it up to dependent items...

[Daugava]

Thank you. That was actually the question, how to create a Dependent Item from the existing Log Item using an EventID filter, rather than collecting it again through the Agent.

[cyber]

ah yeah.. sry.. reading a bit in "diagonal". There is no option to do preprocessing based on EventID.. You can set regex only on that message text..
By creating a separate item, you will definitely not double the agent load.. but as you have already very general catch there, then you will pick up some stuff twice... So some should be excluded from "catch all".

[Daugava]

Thank you.
I will create new Items for the required eventids, and in the old one I will add the eventid to the exceptions using regex

eventlog[Application,,"Warning|Error",,,"^(?!(1000)$).*$",skip]