I have installed ELKwin from https://www.itefix.net/elkwin - very nice solution to get the ELK-Stack running in seconds. If I'm honest, I am very new to the ELK-Stack and it is not so easy to start...
On the ELK-server I collect all the Windows event logs from all other Windows-Servers. That is running well.
Now I have installed Winlogbeat (5.0.0 alpha5) to send all that collected events to Logstash - that is also running. Winlogbeat 1.3.1 did not show all messages correctly, which I have used before.
But I have one problem - the message data is splitted into several fields, from event_data.param 1 - event_data.param 30.
How can I fix that? Or is that normal?
Here's my winlogbeat.yml:
winlogbeat.registry_file: C:/Elkwin_Free_x64/winlogbeat/.winlogbeat.yml winlogbeat.event_logs: - name: ForwardedEvents level: critical, error, warning forwarded: true output.elasticsearch: hosts: ["localhost:9200"] logging.to_files: true logging.files: path: C:/Elkwin_Free_x64/winlogbeat/Logs rotateeverybytes: 10485760 # = 10MB keepfiles: 7
Thank you very much for your help!