New-AzWindowsEventLogDataSourceObject

Module:

Az.Monitor

Create an in-memory object for WindowsEventLogDataSource.

Syntax

New-AzWindowsEventLogDataSourceObject
   [-Name <String>]
   [-Stream <String[]>]
   [-XPathQuery <String[]>]
   [<CommonParameters>]

Description

Create an in-memory object for WindowsEventLogDataSource.

Examples

Example 1: Create a windows event log data source object

New-AzWindowsEventLogDataSourceObject -Name cloudSecurityTeamEvents -Stream Microsoft-WindowsEvent -XPathQuery "Security!"

Name                    Stream                   XPathQuery
----                    ------                   ----------
cloudSecurityTeamEvents {Microsoft-WindowsEvent} {Security!}

This command creates a windows event log data source object with XPathQuery.

Example 2: Create a windows event log data source object

New-AzWindowsEventLogDataSourceObject -Name appTeam1AppEvents -Stream Microsoft-WindowsEvent -XPathQuery "System![System[(Level = 1 or Level = 2 or Level = 3)]]","Application!*[System[(Level = 1 or Level = 2 or Level = 3)]]"

Name              Stream                   XPathQuery
----              ------                   ----------
appTeam1AppEvents {Microsoft-WindowsEvent} {System![System[(Level = 1 or Level = 2 or Level = 3)]], Application!*[System[(Level = 1 or Level = 2 or Level = 3)]]}

This command creates a windows event log data source object with XPathQueries.

Parameters

-Name

A friendly name for the data source. This name should be unique across all data sources (regardless of type) within the data collection rule.

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Stream

List of streams that this data source will be sent to. A stream indicates what schema will be used for this data and usually what table in Log Analytics the data will be sent to.

Type:	String[]
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-XPathQuery

A list of Windows Event Log queries in XPATH format.

Type:	String[]
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

Outputs

WindowsEventLogDataSource