# Global Filter for Windows Source Groups | Logmanager

Download a pre-configured global filter that allows you to configure all your Logmanager Windows Agents in a single step so that different Windows sources send different types of events.

 [Download Filter](https://logmanager.com/wp-content/uploads/2026/06/global-beats-filter-windows.xml_.zip) 

            

This global filter is intended for users who need to connect hundreds or even thousands of Windows agents to Logmanager and configure different groups of agents to send different types of events.

The filter is ready to use immediately. At the same time, it serves as an example of the available possibilities and underlying principles. You can modify it, change source name patterns, adjust what is filtered, or add additional conditional branches to fit your environment.





## What Problems Does This Global Filter Solve?

[Logmanager Windows Agent](https://doc.logmanager.com/latest/logmanager-windows-agent/logmanager-windows-agent/) is software for Windows servers and endpoints that collects events and logs directly from Windows and securely forwards them to Logmanager. It also enables centralized management through the Logmanager web interface. Using filters, the agent can be configured to forward only selected Windows events.

Configuring specific filters across a large number of Logmanager Windows Agents can be time-consuming, as it typically requires accessing each device individually and configuring rules manually.

This global filter significantly simplifies that process. In a single configuration step, you can define which events should be sent to Logmanager based on either a portion of the source system name or its full hostname.

For example, you can collect different types of events from critical servers, standard servers, and workstations. In practice, you might choose to collect only logon events from all desktop PCs, while collecting both user logon events and VPN connection events from laptops.

**This filter is particularly useful for organizations that:**

- Have a large number (hundreds to thousands) of Windows sources connected to Logmanager.
- Need to filter Windows events based on the source hostname.
- Have a small number of systems that require exceptions to the standard rules.
- Use a consistent naming convention for Windows devices. For example, all workstations begin with **PC** (or Pc, pc, etc.), while all laptops begin with **NTB** (or Ntb, ntb, etc.).

## Applying the Filter

![global filter setup windows](https://logmanager.com/wp-content/uploads/2026/06/global-filter-setup-windows-agent-1024x686.png)Applying the filter is straightforward:

1. Open the **Sources** section in the Logmanager web interface.
2. Navigate to **Beats Filters**.
3. Create a new filter and assign it a name.
4. Paste the downloaded filter into the **XML** tab.

## Practical Example

![Global filter setup for windows agents](https://logmanager.com/wp-content/uploads/2026/06/beats-global-filter-setup-windows.png)- If the source name begins with **“PC”**, all events are discarded except Event IDs **4624** and **4625** (successful and failed logon events).
- If the source name begins with **“NTB”**, all events are discarded except Event IDs **4624** and **4625** (successful and failed logon events) and Event IDs **20225** and **20226** (VPN connection and disconnection events).
- If the source name is not **DC01**, **DC02**, **EXCHANGE**, or **CA01**, all events are discarded except those from the **System**, **Security**, and **Application** channels.

In all other cases (that is, when the source name is **DC01**, **DC02**, **EXCHANGE**, or **CA01**), no events are discarded and all events are forwarded to Logmanager. For all other servers, only events from the **System**, **Security**, and **Application** channels are forwarded.