Event Log XML Filtering

Been doing a lot with Elastic Stack and log ingestion. I had a very basic configuration file for NXlog for grabbing security events. However, I was getting lots of eventlogs into ElasticStack that I was not filtering on. So, as always, better to filter at the beginning and not at the end. I used this blog to help me understand my filtering a lot better. This in turn reduced my number of events going into ElasticStack

https://blogs.technet.microsoft.com/askds/2011/09/26/advanced-xml-filtering-in-the-windows-event-viewer/