exclude eventid from winevtlog plugin

[joyartoun]

Hey all,

Is there a way of excluding a certain eventid using the winevtlog plugin?

I have tried the following but it doesnt work

[INPUT]
    Name         winevtlog
    Channels     Setup,Windows PowerShell,System,Security,Application
    Interval_Sec 5
    storage.type filesystem
    Mem_Buf_Limit 100MB
    Read_Existing_Events false
[FILTER]
    Name              grep
    Match             *
    Exclude           EventID 4624  
[OUTPUT]
    tenant_id 11
    name loki
    host <redacted>
    port 80
    match *
    labels job=winevtlog,host=<redacted>
    storage.total_limit_size  200M
    label_keys $Channel,$EventID,$ThreadID

[patrick-stephens]

Is the ID a numeric value rather than a string? I think it might need converting to a string value to work with grep.