How to configure syslog output in winlogbeat

Elastic Stack Beats
1

In the documentation https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-logging.html
there is a configuration option:
logging.to_syslog
When true, writes all logging output to the syslog.

while there isn't a description about how to configure the output destination address and port. Any one can show me how?

2

I've followed the code path of the to_syslog option and this feature should only work under unix system, if you use that under windows you should see the following error in your log.

syslog is not supported on this OS

I will create an issue to remove that documentation in windows.

3

In your case I think you might want to use the 'to_eventlog' option to send events to the events log.

4

I'm looking for options to send log to syslog. Any idea? I overheard some kind of output plugin. Is that possible?

5

@Nickname_Yu The option you were referring was to send Winlogbeat own logs to Syslog. It that the goal you were trying to achieve OR you want to send all the events read from Winlogbeat to a Syslog server?

6

I want to send all the logs to syslog

7

@Nickname_Yu currently Winlogbeat or any beats don't have any direct output to Syslog, we support the following outputs:

  • Elasticsearch
  • Logstash
  • Kafka
  • Redis

If you really want to send all your events to syslog, I think you have the following options:

  • Write a custom Syslog output for beats using our framewok (Syslog is a UDP or TCP connection a string format)
  • Use Logstash as an aggregator with the logstash-output-tcp to send events to Syslog.
  • If you are not using or planning to use Elasticsearch as a backend, maybe NXLog would solve your problem.
8

thanks @pierhugues

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.