<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"></meta><title>ConsumeWindowsEventLog</title><link rel="stylesheet" href="../../../../../css/component-usage.css" type="text/css"></link></head><script type="text/javascript">window.onload = function(){if(self==top) { document.getElementById('nameHeader').style.display = "inherit"; } }</script><body><h1 id="nameHeader" style="display: none;">ConsumeWindowsEventLog</h1><h2>Description: </h2><p>Registers a Windows Event Log Subscribe Callback to receive FlowFiles from Events on Windows.  These can be filtered via channel and XPath.</p><p><a href="additionalDetails.html">Additional Details...</a></p><h3>Tags: </h3><p>ingest, event, windows</p><h3>Properties: </h3><p>In the list below, the names of required properties appear in <strong>bold</strong>. Any other properties (not in bold) are considered optional. The table also indicates any default values, and whether a property supports the <a href="../../../../../html/expression-language-guide.html">NiFi Expression Language</a>.</p><table id="properties"><tr><th>Display Name</th><th>API Name</th><th>Default Value</th><th>Allowable Values</th><th>Description</th></tr><tr><td id="name"><strong>Channel</strong></td><td>channel</td><td id="default-value">System</td><td id="allowable-values"></td><td id="description">The Windows Event Log Channel to listen to.<br/><strong>Supports Expression Language: true (will be evaluated using variable registry only)</strong></td></tr><tr><td id="name"><strong>XPath Query</strong></td><td>query</td><td id="default-value">*</td><td id="allowable-values"></td><td id="description">XPath Query to filter events. (See https://msdn.microsoft.com/en-us/library/windows/desktop/dd996910(v=vs.85).aspx for examples.)<br/><strong>Supports Expression Language: true (will be evaluated using variable registry only)</strong></td></tr><tr><td id="name"><strong>Maximum Buffer Size</strong></td><td>maxBuffer</td><td id="default-value">1048576</td><td id="allowable-values"></td><td id="description">The individual Event Log XMLs are rendered to a buffer.  This specifies the maximum size in bytes that the buffer will be allowed to grow to. (Limiting the maximum size of an individual Event XML.)</td></tr><tr><td id="name"><strong>Maximum queue size</strong></td><td>maxQueue</td><td id="default-value">1024</td><td id="allowable-values"></td><td id="description">Events are received asynchronously and must be output as FlowFiles when the processor is triggered.  This specifies the maximum number of events to queue for transformation into FlowFiles.</td></tr><tr><td id="name"><strong>Inactive duration to reconnect</strong></td><td>inactiveDurationToReconnect</td><td id="default-value">10 mins</td><td id="allowable-values"></td><td id="description">If no new event logs are processed for the specified time period, this processor will try reconnecting to recover from a state where any further messages cannot be consumed. Such situation can happen if Windows Event Log service is restarted, or ERROR_EVT_QUERY_RESULT_STALE (15011) is returned. Setting no duration, e.g. '0 ms' disables auto-reconnection.<br/><strong>Supports Expression Language: true (will be evaluated using variable registry only)</strong></td></tr></table><h3>Relationships: </h3><table id="relationships"><tr><th>Name</th><th>Description</th></tr><tr><td>success</td><td>Relationship for successfully consumed events.</td></tr></table><h3>Reads Attributes: </h3>None specified.<h3>Writes Attributes: </h3><table id="writes-attributes"><tr><th>Name</th><th>Description</th></tr><tr><td>mime.type</td><td>Will set a MIME type value of application/xml.</td></tr></table><h3>State management: </h3>This component does not store state.<h3>Restricted: </h3>This component is not restricted.<h3>Input requirement: </h3>This component does not allow an incoming relationship.<h3>System Resource Considerations:</h3>None specified.</body></html>