import org.hyperic.sigar.win32.EventLogRecord; //导入依赖的package包/类
@Override
public void handleNotification(EventLogRecord record) {
    LOG.debug("EventLogRecord: {}", record);

    final MessageBuilder builder = messageBuilder
            .copy()
            .message(isNullOrEmpty(record.getMessage()) ? "empty" : record.getMessage().trim())
            .timestamp(getDateTime(record.getTimeGenerated()))
            .level(getMessageLevel(record));

    builder.addField("event_source", record.getSource());
    builder.addField("event_category", record.getCategory());
    builder.addField("event_category_string", record.getCategoryString());
    builder.addField("event_computer_name", record.getComputerName());
    builder.addField("event_id", record.getEventId());
    builder.addField("event_type", record.getEventType());
    builder.addField("event_type_string", record.getEventTypeString());
    builder.addField("event_log_name", record.getLogName());
    builder.addField("event_record_number", record.getRecordNumber());
    builder.addField("event_time_generated", getDateTime(record.getTimeGenerated()).toString());
    builder.addField("event_time_written", getDateTime(record.getTimeWritten()).toString());
    builder.addField("event_user", isNullOrEmpty(record.getUser()) ? "" : record.getUser());

    buffer.insert(builder.build());
}
 

import org.hyperic.sigar.win32.EventLogRecord; //导入依赖的package包/类
/**
 * Returns the @{code Message.Level} for the given {@code EventLogRecord}.
 *
 * See: https://msdn.microsoft.com/en-us/library/windows/desktop/aa363646(v=vs.85).aspx
 *
 * @param record the eventlog record
 * @return the mapped message level
 */
private Message.Level getMessageLevel(EventLogRecord record) {
    switch (record.getEventType()) {
        case 1: // EVENTLOG_ERROR_TYPE
            return Message.Level.ERROR;
        case 2: // EVENTLOG_WARNING_TYPE
            return Message.Level.WARNING;
        case 4: // EVENTLOG_INFORMATION_TYPE
            return Message.Level.INFO;
        case 8: // EVENTLOG_AUDIT_SUCCESS
            return Message.Level.INFO;
        case 16: // EVENTLOG_AUDIT_FAILURE
            return Message.Level.ERROR;
        default:
            return Message.Level.INFO;
    }
}
 

import org.hyperic.sigar.win32.EventLogRecord; //导入依赖的package包/类
public EventLogRecord buildEventLogRecord() {
    final EventLogRecord record = mock(EventLogRecord.class);

    when(record.getMessage()).thenReturn("The log message");
    when(record.getSource()).thenReturn("Service Control Manager");
    when(record.getCategory()).thenReturn((short) 0);
    when(record.getCategoryString()).thenReturn("None");
    when(record.getComputerName()).thenReturn("IE10Win7");
    when(record.getEventId()).thenReturn(4567L);
    when(record.getEventType()).thenReturn((short) 4);
    when(record.getEventTypeString()).thenReturn("Information");
    when(record.getLogName()).thenReturn("System");
    when(record.getRecordNumber()).thenReturn(1234L);
    when(record.getTimeGenerated()).thenReturn(0L);
    when(record.getTimeWritten()).thenReturn(1L);
    when(record.getUser()).thenReturn(null);

    return record;
}
 

import org.hyperic.sigar.win32.EventLogRecord; //导入依赖的package包/类
public void handleNotification(EventLogRecord event) {
    System.out.println(event);
}
 

import org.hyperic.sigar.win32.EventLogRecord; //导入依赖的package包/类
public boolean matches(EventLogRecord event) {
    return true;
}
 

import org.hyperic.sigar.win32.EventLogRecord; //导入依赖的package包/类
@Override
public boolean matches(EventLogRecord eventLogRecord) {
    return true;
}