To visualize Windows Event Logs I've setup an ELK server running all 3 components on the same box. Think for testing and learning ELK should be doable. Logs forwarded are account lockouts (Event ID 4740) from Domain Controllers. I was able to pull in and visualize some of these forwarded logs but …

Found it. I had Logstash installed in "Program Files\Logstash", changed to a folder with no " " and now it runs. I wonder why it had worked before. Mayb during my first try is was ingesting directly in ES. Anyway thanks for your help Christion. Really appreciate it. Regards.

system (system) Closed October 24, 2017, 2:04pm 15

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Winlogbeat connecting to server then times out Beats winlogbeat	3	521	August 21, 2018
Problems with winlogbeat Logstash	11	1222	March 12, 2018
Winlogbeat actively refused by target Beats	14	6383	August 19, 2016
Can't get winlogbeat to send logs Beats winlogbeat	6	3538	July 12, 2017
ERR Connecting error publishing events Beats winlogbeat	3	1792	April 18, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

ERR Failed to publish events caused by: read tcp 127.0.0.1:50248->127.0.0.1:5601: i/o timeout

Related topics