To visualize Windows Event Logs I've setup an ELK server running all 3 components on the same box. Think for testing and learning ELK should be doable. Logs forwarded are account lockouts (Event ID 4740) from Domain Controllers. I was able to pull in and visualize some of these forwarded logs but …

Found it. I had Logstash installed in "Program Files\Logstash", changed to a folder with no " " and now it runs. I wonder why it had worked before. Mayb during my first try is was ingesting directly in ES. Anyway thanks for your help Christion. Really appreciate it. Regards.

daffe0x77 September 26, 2017, 12:42pm 8

Logstash config file
json

Winlogbeat

Topic		Replies	Views
Winlogbeat connecting to server then times out Beats winlogbeat	3	520	August 21, 2018
Problems with winlogbeat Logstash	11	1219	March 12, 2018
Winlogbeat actively refused by target Beats	14	6383	August 19, 2016
Can't get winlogbeat to send logs Beats winlogbeat	6	3536	July 12, 2017
ERR Connecting error publishing events Beats winlogbeat	3	1791	April 18, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

ERR Failed to publish events caused by: read tcp 127.0.0.1:50248->127.0.0.1:5601: i/o timeout

Related topics