Edit

InputType Complex Type

  • Article

Defines an input data type.

<xs:complexType name="InputType">
    <xs:sequence>
        <xs:element name="description"
            type="string"
         />
        <xs:element name="outType"
            type="OutputType"
            minOccurs="0"
            maxOccurs="unbounded"
         />
        <xs:any
            processContents="lax"
            namespace="##other"
         />
    </xs:sequence>
    <xs:attribute name="name"
        type="QName"
        use="required"
     />
    <xs:attribute name="value"
        type="string"
        use="required"
     />
    <xs:attribute name="symbol"
        type="CSymbolType"
        use="required"
     />
</xs:complexType>

Child elements

Element Type Description
description string A description of the input type.
outType OutputType A list of output data types that determine how the data is rendered. You must specify at least one output type. Specify a list if the input type can be rendered as different output types. For example, the input type win:UInt16 can be rendered as an unsigned short, port number, or hexadecimal number. One of the output types that you specify must have the default attribute set to true.

Attributes

Name Type Description
name QName The name of the input type.
symbol CSymbolType The symbol to use to reference the input type in your application. The Message Compiler (MC.exe) uses the symbol to create a constant for the input type in the header file that the compiler generates.
value string A numeric identifier that uniquely identifies the input type in a list of input types that you define.

Remarks

The following lists the recognized input types that you can use in your manifest. The types are defined in the \Include\Winmeta.xml file that is included in the Windows SDK. The "Standard XML format" column indicates the canonical type for the specific input type. The "Output type" column lists the possible formats in which the data can be rendered. If you do not specify an output type for the data item, the service will use the first output type listed to render the data. For a description of the output types, see the OutputType complex type.

The following table lists values defined in the Winmeta.xml file.

Input type Description Output type
win:AnsiString A string of 8-bit characters. By default or when used with the xs:string output type, the string is assumed to have been encoded using the event provider s ANSI code page. When used with the win:Xml, win:Json, or win:Utf8 output types, the string is assumed to have been encoded using UTF-8. xs:string,
win:Xml
Starting with mc.exe version 10.0.14251 or later:
win:Json
win:Utf8
win:UnicodeString A string of 16-bit characters. By default, assumed to have been encoded using UTF-16LE. xs:string
win:Xml
Starting with mc.exe version 10.0.14251 or later:
win:Json
win:Int8 A signed 8-bit integer. When used with the xs:string output type, this will be treated as a character. xs:byte
Starting with mc.exe version 10.0.14251 or later:
xs:string
win:UInt8 An unsigned 8-bit integer. When used with the xs:string output type, this will be treated as a character. xs:unsignedByte
Starting with mc.exe version 10.0.14251 or later:
xs:string
win:Int16 A signed 16-bit integer. xs:short
win:UInt16 An unsigned 16-bit integer. When used with the win:Port output type, the data is treated as big-endian (network byte order). When used with the xs:string output type, this will be treated as a character. xs:unsignedShort
win:Port
win:HexInt16
Starting with mc.exe version 10.0.14251 or later:
xs:string
win:Int32 A signed 32-bit integer. xs:int
win:HResult
win:UInt32 An unsigned 32-bit integer. xs:unsignedInt
win:PID
win:TID
win:IPv4
win:ETWTIME
win:Win32Error
win:NTSTATUS
win:HexInt32
win:Int64 A signed 64-bit integer. xs:long
win:UInt64 An unsigned 64-bit integer. xs:unsignedLong
win:ETWTIME
win:HexInt64
win:Float An IEEE 4-byte floating-point number. xs:float
win:Double An IEEE 8-byte floating-point number. xs:double
win:Boolean A 32-bit value where 0 is false and 1 is true. xs:boolean
win:Binary Binary data of variable size. The size must be specified in the data definition as a constant or a reference to another (integer) data item.For an IP V6 address, the data should be an IN6_ADDR structure.
For a socket address, the data should be a SOCKADDR_STORAGE structure. The AF_INET, AF_INET6, and AF_LINK address families are supported.
Starting with mc.exe version 10.0.14251 or later, binary data can use output type win:Pkcs7WithTypeInfo. This data should be a PKCS#7 message (e.g. encrypted and/or signed data). The PKCS#7 message may optionally be followed by TraceLogging type information that indicates the type of the inner content. If present, the TraceLogging type information should immediately follow the PKCS#7 message (i.e. the type information is not included within the PKCS#7 content). To specify the input type of the inner content, append one byte with a value from the TlgIn_t enumeration (defined in TraceLoggingProvider.h). To specify the input and output types of the inner content, append one byte with a value from the TlgIn_t enumeration and with the byte s high bit set, and append a second byte with a value from the TlgOut_t enumeration.
 xs:hexBinary
win:IPv6
win:SocketAddress
Starting with mc.exe version 10.0.14251 or later:
win:Pkcs7WithTypeInfo
win:GUID A GUID structure. On output, the GUID is rendered in the registry string form, {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}. xs:GUID
win:Pointer An unsigned 32-bit or 64-bit pointer value. The size depends on the architecture of the computer logging the event. win:HexInt64
win:FILETIME A FILETIME structure, 8-bytes. xs:dateTime
win:DateTimeCultureInsensitive
win:SYSTEMTIME A SYSTEMTIME structure, 16-bytes. xs:dateTime
win:DateTimeCultureInsensitive
win:SID A security identifier (SID) structure that uniquely identifies a user or group. On output, the SID is rendered in string form using the ConvertSidToStringSid function. xs:string
win:HexInt32 A hexadecimal representation of an unsigned 32-bit integer win:HexInt32
win:Win32Error
win:NTSTATUS
win:HexInt64 A hexadecimal representation of an unsigned 64-bit integer. win:HexInt64

If you use win:UInt32 to store an IPv4 address, the value must be in network byte order. To convert an IPv4 address string to an unsigned integer in network byte order, call the RtlIpv4StringToAddress or inet_addr function. To convert the unsigned integer to an IPv4 address string, call the RtlIpv4AddressToString or inet_ntoa function.

Requirements

Requirement Value
Minimum supported client
 Windows Vista [desktop apps only]
Minimum supported server
 Windows Server 2008 [desktop apps only]