ConsumeWindowsEventLog

ConsumeWindowsEventLog 2.0.0

Bundle: org.apache.nifi | nifi-windows-event-log-nar
Description: Registers a Windows Event Log Subscribe Callback to receive FlowFiles from Events on Windows. These can be filtered via channel and XPath.
Tags: event, ingest, windows
Input Requirement: FORBIDDEN
Supports Sensitive Dynamic Properties: false

Properties

Channel
The Windows Event Log Channel to listen to.

Display Name

Channel

Description

The Windows Event Log Channel to listen to.

API Name

channel

Default Value

System

Expression Language Scope

Environment variables defined at JVM level and system properties

Sensitive

false

Required

true
Inactive duration to reconnect
If no new event logs are processed for the specified time period, this processor will try reconnecting to recover from a state where any further messages cannot be consumed. Such situation can happen if Windows Event Log service is restarted, or ERROR_EVT_QUERY_RESULT_STALE (15011) is returned. Setting no duration, e.g. '0 ms' disables auto-reconnection.

Display Name

Inactive duration to reconnect

Description

If no new event logs are processed for the specified time period, this processor will try reconnecting to recover from a state where any further messages cannot be consumed. Such situation can happen if Windows Event Log service is restarted, or ERROR_EVT_QUERY_RESULT_STALE (15011) is returned. Setting no duration, e.g. '0 ms' disables auto-reconnection.

API Name

inactiveDurationToReconnect

Default Value

10 mins

Expression Language Scope

Environment variables defined at JVM level and system properties

Sensitive

false

Required

true
Maximum Buffer Size
The individual Event Log XMLs are rendered to a buffer. This specifies the maximum size in bytes that the buffer will be allowed to grow to. (Limiting the maximum size of an individual Event XML.)

Display Name

Maximum Buffer Size

Description

The individual Event Log XMLs are rendered to a buffer. This specifies the maximum size in bytes that the buffer will be allowed to grow to. (Limiting the maximum size of an individual Event XML.)

API Name

maxBuffer

Default Value

1048576

Expression Language Scope

Not Supported

Sensitive

false

Required

true
Maximum queue size
Events are received asynchronously and must be output as FlowFiles when the processor is triggered. This specifies the maximum number of events to queue for transformation into FlowFiles.

Display Name

Maximum queue size

Description

Events are received asynchronously and must be output as FlowFiles when the processor is triggered. This specifies the maximum number of events to queue for transformation into FlowFiles.

API Name

maxQueue

Default Value

1024

Expression Language Scope

Not Supported

Sensitive

false

Required

true
XPath Query
XPath Query to filter events. (See https://msdn.microsoft.com/en-us/library/windows/desktop/dd996910(v=vs.85).aspx for examples.)

Display Name

XPath Query

Description

XPath Query to filter events. (See https://msdn.microsoft.com/en-us/library/windows/desktop/dd996910(v=vs.85).aspx for examples.)

API Name

query

Default Value

*

Expression Language Scope

Environment variables defined at JVM level and system properties

Sensitive

false

Required

true

Relationships

Name	Description
success	Relationship for successfully consumed events.

Writes Attributes

Name	Description
mime.type	Will set a MIME type value of application/xml.