Hello everyone, I am struggling at receiving logs from winlogbeat on Windows Server 2012 R2.
Things to mention:
On Windows Server 2016+ its working completely fine.
On Windows 10 PC (Pro/Home) is working completely fine.
Tried installing old versions of elasticsearch + kibana but still it does not work on 2012 R2
Here is my current and simple configuration (/etc/elasticsearch/elasticsearch.yml):
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 192.168.200.169
http.port: 9200
Kibana configuration:
server.port: 5601
server.host: "192.168.200.169"
elasticsearch.url: "http://192.168.200.169:9200"
elasticsearch.ssl.verificationMode: none
Winlogbeat config:
winlogbeat.event_logs:
- name: Application
ignore_older: 72h
- name: System
- name: Security
- name: ForwardedEvents
tags: [forwarded]
- name: Windows PowerShell
event_id: 400, 403, 600, 800
- name: Microsoft-Windows-PowerShell/Operational
event_id: 4103, 4104, 4105, 4106
setup.template.settings:
index.number_of_shards: 1
setup.kibana:
host: "192.168.200.169:5601"
output.elasticsearch:
hosts: ["192.168.200.169:9200"]
protocol: "http"
When I run winlog with the following command: ".\winlogbeat.exe -c .\winlogbeat.yml -e" it shows same logs on both 2016 and 2012 R2 servers.
Sample Logs:
2021/01/04 12:35:19.401823 eventlogger.go:56: INFO EventLog[Security] successfully published 50 events
2021/01/04 12:35:19.417812 eventlogger.go:56: INFO EventLog[Security] successfully published 50 events
2021/01/04 12:35:19.437800 eventlogger.go:56: INFO EventLog[Security] successfully published 50 events
2021/01/04 12:35:19.453790 eventlogger.go:56: INFO EventLog[Security] successfully published 50 events
2021/01/04 12:35:19.467782 eventlogger.go:56: INFO EventLog[Security] successfully published 50 events
2021/01/04 12:35:19.487770 eventlogger.go:56: INFO EventLog[Security] successfully published 50 events
2021/01/04 12:35:19.505759 eventlogger.go:56: INFO EventLog[Security] successfully published 50 events
2021/01/04 12:35:19.532745 eventlogger.go:56: INFO EventLog[Security] successfully published 50 events
2021/01/04 12:37:03.407636 eventlogger.go:56: INFO EventLog[Windows PowerShell] successfully published 43 events
2021/01/04 12:37:03.407636 eventlogger.go:56: INFO EventLog[System] successfully published 7 events
2021/01/04 12:37:03.416635 eventlogger.go:56: INFO EventLog[Windows PowerShell] successfully published 50 events
2021/01/04 12:37:03.433634 eventlogger.go:56: INFO EventLog[Security] successfully published 49 events
2021/01/04 12:37:03.433634 eventlogger.go:56: INFO EventLog[Windows PowerShell] successfully published 1 events
2021/01/04 12:37:03.446636 eventlogger.go:56: INFO EventLog[Security] successfully published 50 events
2021/01/04 12:37:03.457638 eventlogger.go:56: INFO EventLog[System] successfully published 31 events
2021/01/04 12:37:03.457638 eventlogger.go:56: INFO EventLog[Windows PowerShell] successfully published 18 events
2021/01/04 12:37:03.458638 eventlogger.go:56: INFO EventLog[Security] successfully published 1 events
2021/01/04 12:37:03.467639 eventlogger.go:56: INFO EventLog[Windows PowerShell] successfully published 27 events
2021/01/04 12:37:03.467639 eventlogger.go:56: INFO EventLog[System] successfully published 23 events
2021/01/04 12:37:03.475638 eventlogger.go:56: INFO EventLog[System] successfully published 41 events
2021/01/04 12:37:03.475638 eventlogger.go:56: INFO EventLog[Windows PowerShell] successfully published 9 events
2021/01/04 12:37:03.502640 eventlogger.go:56: INFO EventLog[Windows PowerShell] successfully published 45 events
2021/01/04 12:37:03.502640 eventlogger.go:56: INFO EventLog[System] successfully published 5 events
2021/01/04 12:37:03.509640 eventlogger.go:56: INFO EventLog[Windows PowerShell] successfully published 50 events
2021/01/04 12:37:03.518670 eventlogger.go:56: INFO EventLog[Windows PowerShell] successfully published 48 events
2021/01/04 12:37:03.531641 eventlogger.go:56: INFO EventLog[Security] successfully published 47 events
2021/01/04 12:37:03.531641 eventlogger.go:56: INFO EventLog[Windows PowerShell] successfully published 3 events
2021/01/04 12:37:03.548643 eventlogger.go:56: INFO EventLog[Security] successfully published 50 events
2021/01/04 12:37:03.407636 eventlogger.go:56: INFO EventLog[Windows PowerShell] successfully published 43 events
2021/01/04 12:37:03.407636 eventlogger.go:56: INFO EventLog[System] successfully published 7 events
2021/01/04 12:37:03.416635 eventlogger.go:56: INFO EventLog[Windows PowerShell] successfully published 50 events
2021/01/04 12:37:03.433634 eventlogger.go:56: INFO EventLog[Security] successfully published 49 events
2021/01/04 12:37:03.433634 eventlogger.go:56: INFO EventLog[Windows PowerShell] successfully published 1 events
2021/01/04 12:37:03.446636 eventlogger.go:56: INFO EventLog[Security] successfully published 50 events
2021/01/04 12:37:03.457638 eventlogger.go:56: INFO EventLog[System] successfully published 31 events
2021/01/04 12:37:03.457638 eventlogger.go:56: INFO EventLog[Windows PowerShell] successfully published 18 events
2021/01/04 12:37:03.458638 eventlogger.go:56: INFO EventLog[Security] successfully published 1 events
2021/01/04 12:37:03.467639 eventlogger.go:56: INFO EventLog[Windows PowerShell] successfully published 27 events
2021/01/04 12:37:03.467639 eventlogger.go:56: INFO EventLog[System] successfully published 23 events
2021/01/04 12:37:03.475638 eventlogger.go:56: INFO EventLog[System] successfully published 41 events
2021/01/04 12:37:03.475638 eventlogger.go:56: INFO EventLog[Windows PowerShell] successfully published 9 events
2021/01/04 12:37:03.502640 eventlogger.go:56: INFO EventLog[Windows PowerShell] successfully published 45 events
2021/01/04 12:37:03.502640 eventlogger.go:56: INFO EventLog[System] successfully published 5 events
2021/01/04 12:37:03.509640 eventlogger.go:56: INFO EventLog[Windows PowerShell] successfully published 50 events
2021/01/04 12:37:03.518670 eventlogger.go:56: INFO EventLog[Windows PowerShell] successfully published 48 events
2021/01/04 12:37:03.531641 eventlogger.go:56: INFO EventLog[Security] successfully published 47 events
2021/01/04 12:37:03.531641 eventlogger.go:56: INFO EventLog[Windows PowerShell] successfully published 3 events
2021/01/04 12:37:03.548643 eventlogger.go:56: INFO EventLog[Security] successfully published 50 events