Ingest .sqlaudit logs to Elasticsearch

Elastic Stack Beats
1

Hi Team,

We are trying to ingest the mssql logs (.sqlaudit format) using filebeat (Version 7.16.2). But we are not able to read the logs. Can someone let us know what is the best way to pull the mssql logs and ingest in Elasticsearch.

Thanks,
Sanjay Reddy M.

2

Hi @sanju1323, The best way is to use Microsoft SQL Server integration.

You need to install Elastic agent. It will read all logs and push to Elasticsearch.

3

Hi @ashishtiwari1993,

Thanks for your response.
I'm using Elastic 7.16.2 version and I have a dependency on my application.

Can I use the Elastic agent for 7.16.2 version?

Thanks.