Ingesting Winlogbeat File output Text file

Elastic Stack Logstash
1

Hi,
Apologies if this should be in the Beats section, though I think it should be Logstash.

I need to ingest WInlogbeat events from a system which has WinlogBeats installed but is using a File output, rather than Logstash or Elastic. I'm then retrieving the files, they're located on a completely different isolated environment. That's the reason for the unusual configuration. I'm unsure how I should go about ingesting the JSON in the text files. I'm assuming there is a trick which will we see Logstash immediately understand the structure of the document and I don't need to worry about the writing a Filter.

Or should I be attempting to use Filebeats

I'm using v7.8

Thanks

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.