<source>
  type dsc_monitor 
  tag oms.operation.dsc
  dsc_cache_file %STATE_DIR_WS%/dsc_cache.yml
</source>

<source>
    @type tail
    tag oms.operation.auditd_plugin
    path /var/opt/microsoft/omsconfig/omsconfig.log
    pos_file %STATE_DIR_WS%/omsconfig.log.auditd_plugin.pos
    time_format "%Y/%m/%d %H:%M:%S"
    keep_time_key true
    format multiline
    format_firstline /^\d{4}\/\d{2}\/\d{2}\s+\d{2}:\d{2}:\d{2}:\s+[A-Z]+:\s+/
    format1 /^(?<time>\d{4}\/\d{2}\/\d{2}\s+\d{2}:\d{2}:\d{2}):\s+(?<level>[A-Z]+):\s+((?<path>[^\(]+)\((?<linenumber>\d+)\)|.*):\n/
    format2 /(?<message>.*)/
    read_from_head true
    log_level error
</source>

<filter oms.operation.auditd_plugin>
  @type grep
  regexp1 level ^FATAL$
  regexp2 path ^Scripts\/nxOMSAuditdPlugin.pyc$
</filter>

<filter oms.operation.**>
  type filter_operation
</filter>