How to add new file type called ForwardedEvents in logstash eventlog input plugin?

Elastic Stack Logstash
1

Hi,

Is there anyway we can use ForwardedEvents in logstash with eventlog input plugin?

Windows Os Event log are in encrypted format, because of which the file input is not working i believe, I tried something like below and I dont see logstash able to read anydata other than Application,System and Security.

input {
file {
type => "Win32-EventLog'"
path => ["C:\Windows\System32\winevt\Logs\ForwardedEvents.evtx"]
start_position => "beginning"
}
}

How can I add another file called Forwarded Events?

Thanks

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.