Perhaps showing my ignorance, but is there any reason to keep the
Message from a Windows event, when ingesting into a log system?
Is it the case that these are composed of data from other attributes, for localization/readability, and could be discarded without losing important data?
I don't know if this is the right spot to read, but this seems to point to that case?
Only care about Microsoft-y events. If some random person could in theory write their own event with unique data in the message field via PowerShell or some other ad hoc means, I don't care about that
Ingesting into a logging system, and the
message field bloats storage significantly. Generally, details about the meaning of an event is well documented , or could be explored on a local system when building tooling to expose the data once it ships to the log system, sans