Configuration with multiple IDs

Grafana Alloy
1

Hello,
I want Alloy to send me Windows Event Log with two Event IDs 4066 and 4057. Where is the problem in the configuration below?

loki.write "local" {
  endpoint {
    url = "http://YOUR_LOKI_SERVER_IP:3100/loki/api/v1/push"
  }
}

loki.relabel "windows_mapping" {
  forward_to = [loki.write.local.receiver]

  rule {
    source_labels = ["computer"]
    target_label  = "agent_hostname"
  }
}

loki.process "parse_eventlog" {
  forward_to = [
    loki.relabel.windows_mapping.receiver,
  ]
  
  # Stage to parse JSON
  stage.json {
    expressions = {
      "source"  = "source",
      "EventID" = "EventID",  # Extract the EventID field
    }
  }

  # Stage to filter events based on EventID
  stage.filter {
    expression = "EventID == 4066 || EventID == 4057"
  }

  # Stage to add labels
  stage.labels {
    values = {
      "source"  = "source",
    }
  }
}

loki.source.windowsevent "system" {
  forward_to = [
    loki.process.parse_eventlog.receiver,
  ]
  eventlog_name = "System"
}

loki.source.windowsevent "application" {
  forward_to = [
    loki.process.parse_eventlog.receiver,
  ]
  eventlog_name = "Application"
}

Thank you.