ES version 7.16.2 trying to upload sysmon data using winlogbeat. Cluster has "security" enabled and the winlogbeat clients are now connecting an there are no errors in the ES logs. We are using API keys -- this took some time to sort as one can't use kibaba to generate the keys because winlogbeat …

[image] Russell_Fulton: do I need to create two api keys one with the setup role which we use once to get the index templates and ilm stuff set up and then switch to a key with writer privs? Yes, that's effectively what you will do. Work through the install guide and when running the setup co…

Discuss the Elastic Stack

Problems getting logs in with winlogbeat

Elastic Stack Beats

andrewkroh (Andrew Kroh) April 12, 2022, 1:39am 4

I'm not sure when this was introduced but there is a format selector for the API key the latest version of Kibana.

Topic		Replies	Views
No Alerts in Winlogbeat Beats winlogbeat	4	776	May 1, 2023
Winlogbeat unable to communicate with logstash Logstash	26	1971	February 2, 2023
Unable to get winlogbeat to send to logstash Beats winlogbeat	29	5988	May 25, 2017
Winlogbeat API Key Permissions Beats winlogbeat	5	1244	October 12, 2020
Failed to log events to logstash Beats winlogbeat	10	2473	June 30, 2020

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Problems getting logs in with winlogbeat

Related topics