type dsc_monitor tag oms.operation.dsc dsc_cache_file %STATE_DIR_WS%/dsc_cache.yml @type tail tag oms.operation.auditd_plugin path /var/opt/microsoft/omsconfig/omsconfig.log pos_file %STATE_DIR_WS%/omsconfig.log.auditd_plugin.pos time_format "%Y/%m/%d %H:%M:%S" keep_time_key true format multiline format_firstline /^\d{4}\/\d{2}\/\d{2}\s+\d{2}:\d{2}:\d{2}:\s+[A-Z]+:\s+/ format1 /^(?\d{4}\/\d{2}\/\d{2}\s+\d{2}:\d{2}:\d{2}):\s+(?[A-Z]+):\s+((?[^\(]+)\((?\d+)\)|.*):\n/ format2 /(?.*)/ read_from_head true log_level error @type grep regexp1 level ^FATAL$ regexp2 path ^Scripts\/nxOMSAuditdPlugin.pyc$ type filter_operation