Collecting powershell logs with the old beat version

Elastic Stack Beats
1

Hi!

In order to collect powershell logs by winlogbeat 6.8, I tried to change config file just adding 2 rows under

winlogbeat.event_logs:
-name: Windows Powershell
-name: Microsoft-Windows-Powershell/Operational

Unfortunately, as a result, I see powershell logs only from system. Has anybody faced with this issue?

2

Does the winlogbeat log contain any warnings or errors?

I notice a case issue with the names. Powershell should be PowerShell. Maybe that's the issue.

  - name: Windows PowerShell
  - name: Microsoft-Windows-PowerShell/Operational
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.