So this is a two fold question.
- Using Winlogbeat, when configuring inputs on a collector it looks as though my line is input is being alphabetized.
Input: [{‘name’:‘Security’,‘event_id’:‘4771, 4688, 4624, 5140, 5156, 7045, 4663’}]
Output on a Windows machine:
If I capitalized the ‘N’ in ‘name’ it will resort it correctly and place the name before event_id but then winlogbeats throws an error. Am I doing something wrong?
- Does it matter? It looks as though it is functioning properly but my OCD is flairing up.
Thanks in advanced and sorry if this is a dumb question.