EventId from Windows Eventlog is not the same in graylog

[mafiore]

Example: In the EventLog the ID ist 7036.
In the corresponding graylog entry I can only find
event_id 1073748860
event_record_number 29773.

hmmm...

[ivofrolov]

It's a feature of windows eventlog API (or java library itself) I suppose. Anyway I use this Drools rule to fix the problem.

import org.graylog2.plugin.Message

rule "Rewrite Windows Eventlog Event Id"
    when
        m : Message(hasField("event_id"))
    then
        m.addField("event_id", Long.parseLong(String.valueOf(m.getField("event_id"))) & 0xFFFF);
end