Our programmers code events to custom logs stored in the WinEventLog viewer. Instead of having to update the inputs.conf file for each new application and it's corresponding custom event log, is there a way to utilize wildcards? I know that they work for monitoring file directories, but I am unsure if that approach would work for WinEventLogs. We were thinking of prefacing each custom log with the same text and using wildcard in the inputs.conf. Currently this is not working for us. Example is below:
Log Names would begin with "ABC-"
[WinEventLog:ABC-*]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
sourcetype = dotnet
index = web
Any assistance would be appreciated.