Alerting on Windows Event Log Monitor - How to remove unnecessary texts from alert message ?

mdangol

Hi,

I am setting up alert using Windows Event Log Monitor. The alert triggers as expected when there is certain event is logged. However it includes headers (LogName, Source, Logged, Event ID, Level, User, and Computer information) in the message as below. Is there any way to exclude the headers and just include real information?

Example  (${N=SwisEntity;M=ComponentAlert.WindowsEventMessages}) -

--- Event 1 of 1:

Log Name: Application
Source: test source
Logged: 10/18/2017 14:10:00
Event ID: 3003
Level: Information
User:
Computer: xx

Detected the shutdown of agent on machine

I just want to include 'Detected the shutdown of agent on machine'.

Thanks!

mesverrum

Historically I would have said you were out of luck since orion just takes the entire payload of the event and dumps it all in the dB together,  but they just added a swql replace function and if you got really clever with that I bet you could replace all the data you don't want with a ''