Hi,
I cannot see any messages of ForwardedEvents (WinlogBeats 5.5) in the WebUI.
Setup:
Many Remote Servers <-> Windows Log Subscription <-> One Windows Server Log Collector (Winlogbeats) <-> ELK Stak Server
Messages form local Server Events on the collector are visible.
How does the Best Practice Config look like for that case? e.g. Winlogbeat config, Logstash Input config, Elasticsearch output Config
My Logstash Input config
input {
beats {
port => 5044
ssl => true
ssl_certificate => ".."
ssl_key => ".."
}
}
My Elastic output config
output {
elasticsearch {
hosts => ["localhost:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
My winlogbeat config
#======================= Winlogbeat specific options ==========================
winlogbeat.event_logs:
- name: Application
- name: Security
- name: System
- name: ForwardedEvents
forwarded: true
#include_xml: true
#================================ General =====================================
#================================ Outputs =====================================
#-------------------------- Elasticsearch output ------------------------------
#----------------------------- Logstash output --------------------------------
output.logstash:
# The Logstash hosts
hosts: ["xxx.yyy.zzz.aaa:5044"]
bulk_max_size: 1024
# Optional SSL. By default is off.
# List of root certificates for HTTPS server verifications
ssl.certificate_authorities: ["..."]
# Certificate for SSL client authentication
#ssl.certificate: ".."
# Client Certificate Key
#ssl.key: ".."
#================================ Logging =====================================
#logging.selectors: ["*"]
Kind Regards