Filebeat agent to get Operating System Logs

Elastic Stack Beats
1

Hi Team,

I am using Filebeat agent to get logs from an S3 bucket in my AWS Account and push them into Elasticsearch for visualisation.

I wish to also collect some logs from EC2 instances of OS Linux or Windows (syslogs and win events )
Can filebeat agent be used to achieve this? Or do we require some different agent?

Also, is there a way to push this output from the Beats agent to an S3 bucket along with sending to Elasticsearch stack?

2

The system module is designed exactly for this :slight_smile:

3

Thanks for the prompt reply Mark.

I see that the System module does not support windows logs, will I have to install Winlogbeat agent?

Also, can these logs be sent to an S3 bucket after retrieval?

4

If by Windows logs you mean things in event viewer, yes you need Winlogbeat.

Neither Filebeat and Winlogbeat support output to s3, you would need to use something like Logstash to do that.

5

Thanks Mark. This helps.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.