I saw a posting back in May 2009 that was answered saying this isn't possible yet but was expected to be included in the next release.
Is there now a way to exclude events from being forwarded based on keywords in the message text? I'd like to reduce the "noise" level by not logging extremely routine events such as logins by my monitoring service account. Excluding by event id won't work for me as I only want to exclude certain logins.
TIA
Bill