Getting the IP address of the Winlogbeat host from Logstash

(Aron Pedersen) #1

In the new upcoming Winlogbeat 5.0.0 will it be able to send the computers IP address to logstash, so that in logstash we can add a Geo Location?

(Andrew Kroh) #2

Your question is a little vague, so I will assuming you are asking "Will Winlogbeat 5.0.0 report raw event data in a structured format?" The answer to that question is yes. For example, if the event is 4624 which contains a field called IpAddress, this will be reported by Winlogbeat as event_data.IpAddress. You'll be able to use Logstash to add geoip information to the event. There is a blog post showing how to use Winlogbeat 5.0 + Logstash to visualize remote logon locations.

If you are asking if Winlogbeat will report the IP address for the computer sending the event then the answer is no.

(Magnus B├Ąck) #3

The hostname will however be included so it should be possible to use Logstash's dns filter to resolve the hostname to an IP address. Obviously, only routable non-RFC1918 IP addresses are useful with the geoip filter.

(Aron Pedersen) #4

Thank you Magnus that was exactly what I was looking for. Sorry for my late reply.

(Andrew Kroh) #5