Split Microsoft Sentinel Tables with Multi-Destination Data Collection Rules

Matt_Lowe 

Is it possible to use this to prevent certain logs from being ingested? Xpath for DCR is not customization enough for us to drop certain logs. We are currently trying to drop certain WindowsEvent table logs(windows event forwarding).  This certain event is very noisy and has no value. We could not  find a way to turn off auditing of this event without breaking something else on the windows VM. These logs are under certain EventID but we don't want to exclude all logs that has that EventID, which means xpath fails there. Our query would look something like this: 

    { 
          "streams": [ 
            "Microsoft-Microsoft-WindowsEvent" 
          ], 
          "destinations": [ 
            "myworkspace" 
          ], 
          "transformKql": "source | where EventData has 'string that we would like to exclude'
          "outputStream": "Drop?" 
    }