[event_sources]
definition = (index="wineventlog" OR source=*WinEventLog*)
iseval = 0

[event_sources_xml]
definition = index="wineventlog_xml"
disabled = 0