EVENT_FILTER_LEVEL_KW structure (evntprov.h)

The EVENT_FILTER_LEVEL_KW structure defines event IDs used in an EVENT_FILTER_DESCRIPTOR structure for a stack walk level-keyword filter.

This filter is only applied to events that are otherwise enabled on the logging session, via a level/keyword in the enable call.


typedef struct _EVENT_FILTER_LEVEL_KW {
  ULONGLONG MatchAnyKeyword;
  ULONGLONG MatchAllKeyword;
  UCHAR     Level;
  BOOLEAN   FilterIn;



Bitmask of keywords that determine the category of events to filter on.


This bitmask is optional. This mask further restricts the category of events that you want to filter on. If the event's keyword meets the MatchAnyKeyword condition, the provider will filter the event only if all of the bits in this mask exist in the event's keyword. This mask is not used if MatchAnyKeyword is zero.


Defines the severity level of the event to filter on.


true to filter the events matching the provided names in; false to filter them out.

If set to true, the filtered events will have stacks collected.


Minimum supported client Windows 10, version 1709 [desktop apps only]
Minimum supported server Windows Server 2016 [desktop apps only]
Header evntprov.h