title: Not equal xPath query limitations
body: <p>I need to find logs from EventViewer in Forwarded Events based on computer name, excluding the ones which aren't interesting for me.</p>
  
  <p>My query is like that</p>
  
  <pre><code>*[(System[(Computer!='comp1')]) and 
  (System[(Computer!='comp2')]) and 
  (System[(Computer!='comp3')]) and 
  (System[(Computer!='comp4')]) and 
  (System[(Computer!='comp5')]) and 
  (System[(Computer!='comp6')]) and 
  (System[(Computer!='comp7')]) and 
  (System[(Computer!='comp8')]) and 
  (System[(Computer!='comp9')]) and 
  (System[(Computer!='comp10')]) and 
  (System[(Computer!='comp11')]) and 
  (System[(Computer!='comp12')]) and 
  (System[(Computer!='comp13')]) and 
  (System[(Computer!='comp14')]) and 
  (System[(Computer!='comp15')])]
  </code></pre>
  
  <p>This query works fine unless I add one more condition</p>
  
  <pre><code>and [(Computer!='comp16')])
  </code></pre>
  
  <p>After that filter stops working and all logs are displayed.
  Notice that if I put <code>comp16</code> instead of <code>comp15</code> or instead of <code>comp12</code> everything works fine. So problem is not in the new condition.</p>
  
  <p>The situation is opposite if I use equality filter </p>
  
  <pre><code>(System[(Computer='comp1')]) or 
  (System[(Computer='comp2')]) or
  ...
  (System[(Computer='comp15')]) or 
  (System[(Computer='comp16')]) and so on
  </code></pre>
  
  <p>Filter works fine with much larger queries.</p>
  
  <p>So why not equal operator does not work in large queries?</p>
  
  <p><strong>EDIT</strong></p>
  
  <p>Filter by EventRecordID has the same problem</p>
  
  <p><strong>EDIT 2</strong></p>
  
  <pre><code>&lt;Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"&gt;
   &lt;System&gt;
    &lt;Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /&gt; 
    &lt;EventID&gt;4624&lt;/EventID&gt; 
    &lt;Version&gt;1&lt;/Version&gt; 
    &lt;Level&gt;0&lt;/Level&gt; 
    &lt;Task&gt;12544&lt;/Task&gt; 
    &lt;Opcode&gt;0&lt;/Opcode&gt; 
    &lt;TimeCreated SystemTime="2017-08-18T17:06:15.595105400Z" /&gt; 
    &lt;EventRecordID&gt;1&lt;/EventRecordID&gt; 
    &lt;Correlation /&gt; 
    &lt;Execution ProcessID="584" ThreadID="7100" /&gt; 
    &lt;Channel&gt;Security&lt;/Channel&gt; 
    &lt;Computer&gt;comp1&lt;/Computer&gt; 
    &lt;Security /&gt; 
   &lt;/System&gt;
  &lt;EventData&gt;
    &lt;Data Name="TargetUserName"&gt;userName&lt;/Data&gt; 
    &lt;Data Name="TargetDomainName"&gt;DOMAIN&lt;/Data&gt; 
    ...
    &lt;Data Name="ProcessName"&gt;-&lt;/Data&gt; 
    &lt;Data Name="IpAddress"&gt;-&lt;/Data&gt; 
    &lt;Data Name="IpPort"&gt;-&lt;/Data&gt; 
   &lt;/EventData&gt;
  &lt;/Event&gt;
  </code></pre>