Custom information in Winlogbeat events

Elastic Stack Beats
1

Hi,

Is there any way to include custom hardware information like serial number the events that Winlogbeat sends? By default, I see that the hostname and Winlogbeat version is included by default but I would like to include the serial number of the Windows device that publishes logs so it's stamped in each event.

Any way to achieve this?

Thanks!

2

Hi,

Starting with Beats 6.3, you have the add_host_metadata processor:


https://www.elastic.co/guide/en/beats/filebeat/current/add-host-metadata.html

However, it includes OS information and not hardware / serial number information, so probably not what you need.

The only way that comes to mind is to add fields or tags with the required information to the configuration. But this has to be done to the winlogbeat.yml configuration by yourself, although is possible to automate it when deploying the configuration in multiple servers, if you have the required tools in place.

https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-general-options.html

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.