Filter text from Windows Event Viewer

[wagnerjs83]

Hi,


Is it possible to collect selected text in log?

Item: Log (Event Viewer Windows)

Key: eventlog[System,,"Warning"]


is it possible to filter log content?

Ex:
Name: System
Level: Warning
General: The Software Protection service has completed licensing status check.
Filter: service has completed


Thanks

[sancho]

Hello wagnerjs83,

In the item -> preprocessing -> regular expression

https://www.zabbix.com/documentation/4.0/manual/config/items/item

This website can help you with the regular expression

https://regex101.com/

[wagnerjs83]

Hi Sancho,

How's the expression? regexp to string "service has completed"?

[sancho]

Hi wagnerjs83,

Sorry, I think I did not understand you, what do you need, a trigger that alerts you when the text "service has completed" appears?

[wagnerjs83]

Hi,

I need an item that filters a string

Item: Log (Event Viewer Windows)

Key: eventlog[System,,"Warning"]

String "abcd 123 abcd"

[sancho]

wagnerjs83,
In the web that I indicated, https://regex101.com/ you can look for the regexp that you need.
I'm not very good with the regexp but it would be worth something like this "service + [a-z \ s] + completed"

But surely there are more simple ones.

The regexp tb you can use it in the key instead of the preprocessing