Hello using winlogbeat and elasticsearch as the output (not logstash) can i create a key-value pari lookup database?
use case:
For event_id: 4625 i would like to include fields or do a lookup for the Status and Substatus fields, eg.
Is this best achieved with a processor?, such as below or something else?
processors:
-add_fields:
when:
event_data.Status: 0xc000006d
fields:
"event_data.Status.Description": "This is either due to a bad username or authentication information"
You could accomplish this with either a series of add_fields processors on the Winlogbeat side or using an Ingest Node pipeline in Elasticsearch. With Ingest Node you would using the script processor to translate status codes.
For add_fields it would be a series of processors:
processors:
- add_fields:
when:
event_data.Status: "0xc000006d"
fields:
event_data.Status_Description: This is either due to a bad username or authentication information.
target: ""
- add_fields:
when:
event_data.Status: "0x123"
fields:
event_data.Status_Description: One two three
target: ""
And BTW in Winlogbeat 7.2.0 there will be a new script processor that could be used too, but it's not released yet. With that new script processor you could write a switch statement.
You would filter on the event id, 4625, use the "fields" setting to add the human readable string you want for a particular status and use the drop-event processor to drop all the events which do not have the status corresponding to the human readable string you just put in the fields setting.
Then rinse and repeat, add the same event_logs entry n times always just changing the string in "fields" and status code you don't drop.
So collect the same eventid through multiple collectors and always dropping the status that don't match (or go with...) the string. Once they're all there you should get what you want in the output.
Only thing I don't know is if winlogbeat allows you to filter on the same eventid multiple times. Never tried that but at face value I don't see why it would not be valid.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.