Remove Windows Event Messages
Removes the Message element content from Windows Event XML logs to reduce log size while preserving the structured event data.
Included Processors
1
Split Event XML
Parses the XML to capture content before and after the Message element.
2
Reconstruct Event XML
Combines the XML parts with empty Message tags to reduce size.
Example Telemetry
Log
| Name | Before | After |
|---|---|---|
| observed_time | 2026-01-02T09:15:00Z | 2026-01-02T09:15:00Z |
| time | 2026-01-02T09:14:58Z | 2026-01-02T09:14:58Z |
| severity_text | INFO | INFO |
| severity_number | 9 | 9 |
Body
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}"/><EventID>4624</EventID><Version>2</Version><Level>0</Level><Task>12544</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime="2026-01-02T09:14:58.123Z"/><EventRecordID>98765</EventRecordID><Channel>Security</Channel><Computer>DC01.corp.example.com</Computer></System><EventData><Data Name="SubjectUserSid">S-1-5-18</Data><Data Name="TargetUserName">jsmith</Data><Data Name="LogonType">3</Data></EventData><Message>An account was successfully logged on. Subject: Security ID: S-1-5-18 Logon Type: 3 New Logon: Account Name: jsmith</Message></Event><Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}"/><EventID>4624</EventID><Version>2</Version><Level>0</Level><Task>12544</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime="2026-01-02T09:14:58.123Z"/><EventRecordID>98765</EventRecordID><Channel>Security</Channel><Computer>DC01.corp.example.com</Computer></System><EventData><Data Name="SubjectUserSid">S-1-5-18</Data><Data Name="TargetUserName">jsmith</Data><Data Name="LogonType">3</Data></EventData><Message></Message></Event>Attributes
| Name | Before | After |
|---|---|---|
| log.windows.channel | Security | Security |
| log.windows.computer | DC01.corp.example.com | DC01.corp.example.com |
Resource
| Name | Before | After |
|---|---|---|
| host.name | DC01.corp.example.com | DC01.corp.example.com |
| os.type | windows | windows |