Monitoring Multiple Windows Event Channels with Custom Event Logs in ELK Stack

Elastic Stack Elastic Agent
1

Hello everyone,

I have an ELK stack to monitor various Windows events. I monitor my agents with the Fleet server and integrations.

I frequently use the "Custom Windows Event Logs" to target specific Event IDs I need.

I want to know if it's possible to target IDs from different channels, i.e., "Security" and "System"?

Thank you for your help!

2

Hi,

I think we can use

event_logs:

  • name: Security
    event_id: [4624, 4634, 4672] # Successful login, logout, admin login
  • name: System
    event_id: [6005, 6006, 1074] # Event log started, stopped, system shutdown

winlog.channel The name of the channel from which this record was read. This value is one of the names from the event_logs collection in the configuration. keyword

Thanks!!