Expressions such as Security!*[System[(EventID=4648)]], placed in a DCR's xPathQueries, that decide which Windows events AMA gathers. Each portal box takes 20 at most, and a DCR is limited to 100.
Also called XML Path Language.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains XPath in context, with comparison tables and the common traps.
Terms in this definition
- Chat message roles
Labels on chat messages: instructions go under system, the person's input under user, the model's previous answers under assistant, and results returned by a called tool under tool (or function).
- Data collection rule
Rule in Azure Monitor specifying what the Azure Monitor Agent or Logs Ingestion API gathers (XPath event filters, for example), any transformation applied, and the destination.
- Azure Monitor agent
Agent now used to collect logs from a machine's guest OS, driven by data collection rules; it took over from the Log Analytics agent (MMA).
Related terms
- DCR transformation
A KQL statement inside a data collection rule that drops or reshapes incoming records before storage. Selecting which Windows events the agent gathers is done with XPath instead.
- Ingestion-time transformation
A KQL statement inside a data collection rule that drops or modifies incoming records before they are written to the workspace. Selecting which Windows events to gather is a separate job, done through XPath.