Unable to Filter the logs by EVENT ID

[saiganeshkABI]

Component(s)

receiver/windowseventlog

Describe the issue you're reporting

I have enabled the Windows Event Log receiver in the OTel collector. I'm unable to filter to only include the event logs coming from Event ID: 102.
waiting-for-author
config.yaml

  windowseventlog:
    channel: Microsoft-Windows-TaskScheduler/Operational
    attributes: {"service":"otel","source":"windows_event"}
    start_at: end
    operators:
    - type: filter
      expr: 'resource.Event.System.EventID == "102"'
    - type: retain
      fields: 
        - resource.Event.System.EventID

[github-actions]

Pinging code owners:

• receiver/windowseventlog: @armstrmi @pjanotti

See Adding Labels via Comments if you do not have permissions to add labels yourself.

[saiganeshkABI]

waiting-for-author

[pjanotti]

I will try to repro it later today.

[pjanotti]

/label os:windows

[pjanotti]

The issue is due to incorrect specification of the filter, the following configuration works:

receivers:
  windowseventlog:
    channel: Microsoft-Windows-TaskScheduler/Operational
    attributes: {"service":"otel","source":"windows_event"}
    start_at: end
    operators:
    - type: filter
      expr: 'body.EventID == "102"'
    - type: retain
      fields:
        - body.event_id.id
exporters:
  debug:
    verbosity: detailed
service:
  pipelines:
    logs:
      receivers: [windowseventlog]
      exporters: [debug]

@djaglowski any suggestions on how to make the the operators expression more discoverable?

@open-telemetry/collector-contrib-triagers this issue can be closed.

cc @saiganeshkABI