I try to enrich the information that I send to Logstash.
I'd like to add a field in the winlogbeat index with a label like administrator and in this field I'd like to set YES for the user that is admin of the pc/server or NO for the user that is not admin of the pc/server.
Is it possible? At the moment I don't found solution...
Hi @vasek I could add a tag ADMIN for the administrators user in the logstash filter, but how could I found the administrators user? In the winlogbeat.yml file could I set this configuration?
In winlogbeat filebeat you can add field for specific log file. This can be useful if you have separated log for adminstrators and users.. e.g.: adminsitrators.log, users.logs.
If you have mixed content in log.. you have to parse eveng, for example using Grok patterns in logstash. Based on result of parsing you can tag events.
if ( [eventID] == 42 or [eventID] == 2019 ) {
do something ... e.g.: add tag or field to document
}
2) Parsing Windows Events
Look at a document which is collected by Filebeat from Windows server. You can use CURL utility or Kibana to see this document. You will parse field where message is present.
You can test your Grok pattern in Kibana - Dev Tools - Grok Debugger. There is nice explanation.
Thank you @vasek I know all information that you give me.
I found a script in windows that give in output all administrator users. Is it possible in winlogbeat to check if the event capture is created by one of this users (that I could store in a text file)?
please allow me to come back to the original question and how identify, which mode the actual beat is running at the moment.
I hope I understood you correctly.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.