I have a server class (wineventlog) that has a whitelist in the inputs.conf. It looks like this:
[WinEventLog://Security]
disabled = 0
index = default
whitelist=4618,4621,4624,4625,4634,4649,4675,4692,4693,4706,4719,4720,4722-4735,4737,4738,4740,4744-4762,4765-4766,4794,4897,4964,1102,4648,5038,6281
This applies to all 14 clients in this server class. However I want to add "2000" to the whitelist but I need it in only one client out of the 14. Is this possible?
↧