Struct WindowsEventLogConfig 

pub struct WindowsEventLogConfig {

    pub channels: Vec<String>,
    pub event_query: Option<String>,
    pub connection_timeout_secs: u64,
    pub read_existing_events: bool,
    pub batch_size: u32,
    pub include_xml: bool,
    pub event_data_format: HashMap<String, EventDataFormat>,
    pub ignore_event_ids: Vec<u32>,
    pub only_event_ids: Option<Vec<u32>>,
    pub max_event_age_secs: Option<u64>,
    pub event_timeout_ms: u64,
    pub log_namespace: Option<bool>,
    pub field_filter: FieldFilter,
    pub data_dir: Option<PathBuf>,
    pub events_per_second: u32,
    pub max_event_data_length: usize,
    pub checkpoint_interval_secs: u64,
    pub render_message: bool,
    pub acknowledgements: SourceAcknowledgementsConfig,
}

Configuration for the windows_event_log source.

Fields

channels: Vec<String>

A comma-separated list of channels to read from.

Common channels include “System”, “Application”, “Security”, “Windows PowerShell”. Use Windows Event Viewer to discover available channels.

event_query: Option<String>

The XPath query for filtering events.

Allows filtering events using XML Path Language queries. If not specified, all events from the specified channels will be collected.

connection_timeout_secs: u64

Connection timeout in seconds for event subscription.

This controls how long to wait for event subscription connection.

read_existing_events: bool

Whether to read existing events or only new events.

When set to true, the source will read all existing events from the channels. When set to false (default), only new events will be read.

batch_size: u32

Batch size for event processing.

This controls how many events are processed in a single batch.

include_xml: bool

Whether to include raw XML data in the output.

When enabled, the raw XML representation of the event is included in the xml field of the output event.

event_data_format: HashMap<String, EventDataFormat>

Custom event data formatting options.

Maps event field names to custom formatting options.

ignore_event_ids: Vec<u32>

Ignore specific event IDs.

Events with these IDs will be filtered out and not sent downstream.

only_event_ids: Option<Vec<u32>>

Only include specific event IDs.

If specified, only events with these IDs will be processed. Takes precedence over ignore_event_ids.

max_event_age_secs: Option<u64>

Maximum age of events to process (in seconds).

Events older than this value will be ignored. If not specified, all events will be processed regardless of age.

event_timeout_ms: u64

Timeout in milliseconds for waiting for new events.

Controls the maximum time WaitForMultipleObjects blocks before returning to check for shutdown signals. Lower values increase shutdown responsiveness at the cost of more frequent wake-ups.

log_namespace: Option<bool>

The namespace to use for logs. This overrides the global setting.

field_filter: FieldFilter

Event field inclusion/exclusion patterns.

Controls which event fields are included in the output.

data_dir: Option<PathBuf>

The directory where checkpoint data is stored.

By default, the global data_dir option is used. Make sure the running user has write permissions to this directory.

events_per_second: u32

Maximum number of events to process per second.

When set to a non-zero value, Vector will rate-limit event processing to prevent overwhelming downstream systems. A value of 0 (default) means no rate limiting is applied.

max_event_data_length: usize

Maximum length for event data field values.

Event data values longer than this will be truncated with “…[truncated]” appended. Set to 0 for no limit.

checkpoint_interval_secs: u64

Interval in seconds between periodic checkpoint flushes.

Controls how often bookmarks are persisted to disk in synchronous mode. Lower values reduce the window of events that may be re-processed after a crash, at the cost of more frequent disk writes.

render_message: bool

Whether to render human-readable event messages.

When enabled (default), Vector will use the Windows EvtFormatMessage API to render localized, human-readable event messages with parameter substitution. This matches the behavior of Windows Event Viewer.

Provider DLL handles are cached per provider, so the performance cost is limited to the first event from each provider. Disable only if you do not need rendered messages and want to eliminate the DLL loads entirely.

acknowledgements: SourceAcknowledgementsConfig

Controls how acknowledgements are handled for this source.

When enabled, the source will wait for downstream sinks to acknowledge receipt of events before updating checkpoints. This provides exactly-once delivery guarantees at the cost of potential duplicate events on restart if acknowledgements are pending.

When disabled (default), checkpoints are updated immediately after reading events, which may result in data loss if Vector crashes before events are delivered to sinks.

Implementations

impl WindowsEventLogConfig

pub fn validate(&self) -> Result<(), Error>

Validate the configuration.

Trait Implementations

impl Clone for WindowsEventLogConfig

fn clone(&self) -> WindowsEventLogConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Configurable for WindowsEventLogConfig

fn referenceable_name() -> Option<&'static str>

Gets the referenceable name of this value, if any.

fn metadata() -> Metadata

Gets the metadata for this value.

fn generate_schema( schema_gen: &RefCell<SchemaGenerator>, ) -> Result<SchemaObject, GenerateError>

Generates the schema for this value.

fn is_optional() -> bool

where Self: Sized,

Whether or not this value is optional.

fn validate_metadata(_metadata: &Metadata) -> Result<(), GenerateError>

where Self: Sized,

Validates the given metadata against this type.

fn as_configurable_ref() -> ConfigurableRef

where Self: Sized + 'static,

Create a new configurable reference table.

impl Debug for WindowsEventLogConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for WindowsEventLogConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for WindowsEventLogConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl GenerateConfig for WindowsEventLogConfig

fn generate_config() -> Value

impl NamedComponent for WindowsEventLogConfig

fn get_component_name(&self) -> &'static str

Gets the name of the component.

impl Serialize for WindowsEventLogConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl SourceConfig for WindowsEventLogConfig

fn build<'life0, 'async_trait>( &'life0 self, _cx: SourceContext, ) -> Pin<Box<dyn Future<Output = Result<Source>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Builds the source with the given context.

fn outputs(&self, global_log_namespace: LogNamespace) -> Vec<SourceOutput>

Gets the list of outputs exposed by this source.

fn resources(&self) -> Vec<Resource>

Gets the list of resources, if any, used by this source.

fn can_acknowledge(&self) -> bool

Whether or not this source can acknowledge the events it emits.

fn send_timeout(&self) -> Option<Duration>

If this source supports timeout returns from the SourceSender and the configuration provides a timeout value, return it here and the out channel will be configured with it.

impl ToValue for WindowsEventLogConfig

fn to_value(&self) -> Value

Convert this value into a serde_json::Value. Must not fail.