receivers:
  windowseventlog/system:
    channel: System
  windowseventlog/application:
    channel: Application

processors:
  memory_limiter:
    check_interval: 1s
    limit_percentage: 80
    spike_limit_percentage: 25
  # Noisy, low-value events, by provider and id. Extend with your own.
  filter/noisy-events:
    error_mode: ignore
    logs:
      log_record:
        - body["provider"]["name"] == "Microsoft-Windows-Security-SPP" and body["event_id"]["id"] == 16384
        - body["provider"]["name"] == "Service Control Manager" and body["event_id"]["id"] == 7036
  # The rendered text is in the body twice - message, and again in
  # rendering_info - and repeats event_data in prose. Keep the structured fields.
  transform/drop-rendered:
    error_mode: ignore
    log_statements:
      - context: log
        statements:
          - delete_key(body, "message")
          - delete_key(body, "rendering_info")
  batch:
    timeout: 5s

exporters:
  otlphttp:
    endpoint: https://your-backend:4318

service:
  pipelines:
    logs:
      receivers: [windowseventlog/system, windowseventlog/application]
      processors: [memory_limiter, filter/noisy-events, transform/drop-rendered, batch]
      exporters: [otlphttp]