# Beatsで収集したログを日次指定してlogstashに送信するには

**URL:** <https://discuss.elastic.co/t/beats-logstash/297841>\
**Category:** 日本語による質問・議論はこちら\
**Created:** [February 22, 2022, 5:44am UTC](https://discuss.elastic.co/t/beats-logstash/297841 "2022-02-22T05:44:31Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![gou\_gemma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gou_gemma/32/102109_2.png) [@gou\_gemma](https://discuss.elastic.co/u/gou_gemma)\
**Post date:** [February 22, 2022, 5:44am UTC](https://discuss.elastic.co/t/beats-logstash/297841/1 "2022-02-22T05:44:31Z")

</div>

winlogbeat,filebeatで収集したログをリアルタイムもしくは日次指定してlogstashに送信する方法が知りたいです。

どのソフトのymlファイルで設定すれば宜しいのでしょうか？

宜しくお願い致します。

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [February 22, 2022, 3:53pm UTC](https://discuss.elastic.co/t/beats-logstash/297841/2 "2022-02-22T15:53:14Z")

</div>

送り手と受け手の双方で設定する必要があると思います。

Winlogbeatのoutput

> **[Configure the Logstash output | Winlogbeat Reference \[8.0\] | Elastic](https://www.elastic.co/guide/en/beats/winlogbeat/current/logstash-output.html)**

Logstashのinput (上記Winlogbeatのdocumentにも同内容の記載があります）

> **[Beats input plugin | Logstash Reference \[8.0\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html)**

---

<div class="post-metadata">

**Author:** ![gou\_gemma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gou_gemma/32/102109_2.png) [@gou\_gemma](https://discuss.elastic.co/u/gou_gemma)\
**Post date:** [February 23, 2022, 1:42am UTC](https://discuss.elastic.co/t/beats-logstash/297841/3 "2022-02-23T01:42:46Z")

</div>

返信ありがとうございます！

logstashのinputドキュメントを見る限りだと、以下のパラメータを編集すれば良いと推察できました。

#### `client_inactivity_timeout` [edit](https://github.com/logstash-plugins/logstash-input-beats/edit/main/docs/index.asciidoc)

```auto
* Value type is [number](https://www.elastic.co/guide/en/logstash/current/configuration-file-structure.html#number)
* Default value is `60`

Close Idle clients after X seconds of inactivity.

```

しかし、winlogbeatのoutputドキュメントは読んでもどれで設定すれば良いか読み解けませんでした・・。もしご存じであればどのパラメータを設定すれば良いかご教示願います💦

宜しくお願い致します！

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [February 23, 2022, 12:19pm UTC](https://discuss.elastic.co/t/beats-logstash/297841/4 "2022-02-23T12:19:38Z")

</div>

> [@Winlogbeat Working](https://discuss.elastic.co/t/winlogbeat-working/163379):
>
> Hi All, How does winlogbeat works exactly, in short? Like what parameters or depending on what conditions or in any specific intervals, data is shipped from client to ELK server? As in filebeat, there is scan\_frequency which is one of the conditions to ship to data. Thank You

> [@Change file scan frequency in Winlogbeat](https://discuss.elastic.co/t/change-file-scan-frequency-in-winlogbeat/162950):
>
> As in filebeat there is an option to change file scan frequency. Can someone please let me know what is for winlogbeat ? Is it "refresh\_frequency:10m" or "rotate\_every\_kb: 10000" ? [https://www.elastic.co/guide/en/beats/winlogbeat/current/file-output.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/file-output.html) My main concern is to know, in what conditions logs are being shipped to Master server via winlogbeat & filebeat.

winlogbeatの場合、inputについては自動的に1秒ごとにWindow Event log APIにアクセスするようです。

outputについては、filebeatにflush.min\_events/flush.timeoutという項目があり、

> **[Configure the internal queue | Filebeat Reference \[8.0\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/8.0/configuring-internal-queue.html#_flush_timeout)**

同様の項目をwinlogbeat.ymlでも設定できるようなので、そちらで設定できるかもしれません。日時指定は難しそうです。

> **[winlogbeat.reference.yml | Winlogbeat Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-reference-yml.html)**

---

<div class="post-metadata">

**Author:** ![gou\_gemma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gou_gemma/32/102109_2.png) [@gou\_gemma](https://discuss.elastic.co/u/gou_gemma)\
**Post date:** [February 23, 2022, 11:17pm UTC](https://discuss.elastic.co/t/beats-logstash/297841/5 "2022-02-23T23:17:15Z")

</div>

ご丁寧にありがとうございます。  
日時指定は難しそうなんですね・・・。  
かしこまりました。

ありがとうございました。

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 23, 2022, 11:17pm UTC](https://discuss.elastic.co/t/beats-logstash/297841/6 "2022-03-23T23:17:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.