How to create an index for Windows Log Event?

Elastic Stack Logstash
1

I have a Winlogbeat set up, and I want to set an explicit index for it as follows:

output {

 elasticsearch {

     if [type] == "wineventlog" {

         hosts => ["localhost:9200"]
         index => "winlogbeat"
    }
}

}

A parser error occurs. When I removed "if" statement, the parser is happy. Can you tell me what is wrong with it. I want an index for each data source (one for winlogbeat and the other topbeat).

Thanks,
Edison

2

Hi Edison,
Conditionals can't be nested into other filters. But I think you could do sth like this for your use case. I've used this with Filebeat.

output {
 elasticsearch  {
   hosts => ["localhost:9200"]
   index => "%{[@metadata][beat]}"
 }
}
3

Hello,

Thank you for the reply.

According to the JSON output for winlogevent beat, [beat] has two fields: hostname and name as follows:

beat {
“hostname” => “xxx”
“name” => “xxx”
}

I don’t know how to get rid of one of them because of identical information. Also, the output does not contain [@metadata]; so it does not really help me at all. What is @metadata? What value does it contain?

Right now, I am using:

Index => “%{type}”

where “type” has the value “winlogevent”. At least, the documents for Windows Log Events are being indexed uniquely to a single index value. But, I really want the index value to be “winlogbeat”, and I cannot hard-code it because not all documents are Windows events. If I add TopBeat, this hard-coded index will contain both documents from winlogbeat and topbeat. Too bad that conditionals in Elasticsearch filter is not supported anymore.

Any other suggestion.

Edison

4

Hi,

There are a couple ways to go about this. You could put the elasticsearch filter inside the conditional:

if [type] == "wineventlog" {
        elasticsearch {
         hosts => ["localhost:9200"]
         index => "winlogbeat"
    }
}

Alternatively use @metadata. From what I know, you can think of @metadata as logstash output. It has all the info the previous filters applied. [@metadata][beat] gives us the name of the beat we're using. In your case that's Winlogbeat.

5

I don’t know how to get rid of one of them because of identical information.

Use the mutate filter's remove_field option.

Also, the output does not contain [@metadata]; so it does not really help me at all. What is @metadata? What value does it contain?

That field contains additional metadata about events that's normally ignored by outputs. See Metadata use cases in Logstash 1.5 | Elastic Blog and Accessing event data and fields | Logstash Reference [8.11] | Elastic.

Too bad that conditionals in Elasticsearch filter is not supported anymore.

Anymore? Conditionals inside plugin declarations have never been supported.