Windows Event Log Ingestion Overview

Last updated - 02 July, 2026

Windows Event Logs provide information about operating system activity, application behavior, security events, and system health across your Windows environment. By ingesting Windows Event Logs into LM Logs, you can investigate issues, create log-based alerts, and correlate Windows events with metrics and alerts from other monitored resources.

LogicMonitor simplifies Windows Event Log collection through the Windows Event Log LogSource. The LogSource provides recommended default settings for event collection and filtering while enabling you to customize ingestion behavior. By default, the LogSource is scoped using isWindows(), so when the LogSource is enabled and the AppliesTo Function is uncommented, Windows Event Logs are collected from all monitored resources that match that Windows criteria.

Windows Event Log LogSource

The Windows Event Log LogSource is included in LogicMonitor Core Modules and enables you to ingest Windows Event Logs into LM Logs. The LogSource is disabled by default, allowing you to choose when to begin collecting events and which Windows resources to monitor.

By default, the LogSource excludes Windows Security Audit Success events to help reduce log volume. If your organization uses Windows Security logs for auditing, compliance, or security investigations, you can modify the filtering configuration to include these events.
For more information, see Windows Event Logging LogSource Configuration.

General Requirements for Ingesting Windows Event Logs to LogicMonitor

To successfully ingest Windows Event Logs, consider the following requirements:

• The Windows Event Log LogSource must be enabled before events can be collected.
• The LogSource must be scoped to the appropriate Windows resources. By default, the LogSource uses isWindows(), which applies to all monitored Windows resources. For controlled deployments, modify the AppliesTo function to target a more specific set of resources.
• Core Modules must be installed and up to date.
• Existing Windows Event Log DataSources or EventSources that collect the same events should be reviewed before deployment.