NXLog Docs


What is XPath?


XPath stands for XML Path Language and uses a "path-like" syntax to identify and navigate nodes in an XML document. You can also use XPath queries to test addressed nodes within a document to determine whether or not they match a specific pattern.

In the world of NXLog

Windows Event Log supports a subset of XPath 1.0. You can use XPath queries to subscribe to events matching specific criteria in Windows Event Viewer and with the QueryXML directive of NXLog’s im_msvistalog module.

Event Viewer offers the most practical way to write and test queries. For example, you can test an XPath query by filtering the current log or creating a custom view. You can copy XPath queries created by Event Viewer directly into an NXLog configuration.

Known as

xpath, windows xpath, xpath filtering, event viewer xml filter


XPath filtering
Filtering Sysmon events
Event Log for Windows 2008/Vista/later (im_msvistalog)

A   B   C   D   E   F   G   H   I   J   K   L   M   N   O   P   R   S   T   U   V   W   X   Z