New-AzWindowsEventLogDataSourceObject
Create an in-memory object for WindowsEventLogDataSource.
Syntax
New-AzWindowsEventLogDataSourceObject
[-Name <String>]
[-Stream <String[]>]
[-XPathQuery <String[]>]
[<CommonParameters>] Description
Create an in-memory object for WindowsEventLogDataSource.
Examples
Example 1: Create a windows event log data source object
New-AzWindowsEventLogDataSourceObject -Name cloudSecurityTeamEvents -Stream Microsoft-WindowsEvent -XPathQuery "Security!"
Name Stream XPathQuery
---- ------ ----------
cloudSecurityTeamEvents {Microsoft-WindowsEvent} {Security!}This command creates a windows event log data source object with XPathQuery.
Example 2: Create a windows event log data source object
New-AzWindowsEventLogDataSourceObject -Name appTeam1AppEvents -Stream Microsoft-WindowsEvent -XPathQuery "System![System[(Level = 1 or Level = 2 or Level = 3)]]","Application!*[System[(Level = 1 or Level = 2 or Level = 3)]]"
Name Stream XPathQuery
---- ------ ----------
appTeam1AppEvents {Microsoft-WindowsEvent} {System![System[(Level = 1 or Level = 2 or Level = 3)]], Application!*[System[(Level = 1 or Level = 2 or Level = 3)]]}This command creates a windows event log data source object with XPathQueries.
Parameters
-Name
A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Stream
List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.
| Type: | String[] |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-XPathQuery
A list of Windows Event Log queries in XPATH format.
| Type: | String[] |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |