Log Exporter FilterConfiguration.xml rule_uid

[Richard_Wieser]

I'm trying to filter logs being sent to our SIEM. In particular, I want to filter out logs based on the rule_uid. 

My FilterConfiguration.xml looks something like this:

<filters>
<filterGroup operator="and">
....
<field name="rule_uid" operator="or">
<value operation="neq">acbdef3b-7777-4a9a-83d4-c7796521fed3</value>
</field>
....
</filterGroup>
</filters>

This will work if the rule_uid is for a top level rule but doesn't seem to work if it's a sub-layer rule. The log will have mulitple rule_uid fields and the filtering seems only pick up the first one. 

rule_uid=7a588c06-7322-4df2-a9b7-e3b153bce877;rule_uid=acbdef3b-7777-4a9a-83d4-c7796521fed3.

Should it possible to filter on any rule_uid in the log?

[PhoneBoy]

There are multiple UIDs, yes, because the top-level rule has a UID as does the sub-layer rule.
I'm guessing the first UID is the top-level rule?

Whether it works (or it is supported) to filter based on a sublayer is a separate question.
Checking with R&D on this.