smam
February 1, 2022, 10:38am
1
Hello,
Where do I find files that i sent via winlogbeat when using the Elasticsearch output? Can I add indexes?
And how could I send just a selection of files, that is e.g. stored in some directory?
I tried:
- name: 'C:\path\to\dir\*'
#and
- name: 'C:\path\to\file'
but neither of them worked.
sholzhauer
(sholzhauer)
February 1, 2022, 2:12pm
2
Hi,
Winlogbeat cannot be used (as far as i know) to send log files. The usage of winlogbeat is meant for sending the windows event logs.
If you want to ingest log files (for example IIS logs), I recommend using Filebeat .
Which would then look something like
filebeat.inputs:
- type: log
paths:
- C:\path\to\dir\*
- C:\path\to\dir\*
(might be you have to use /
instead of \
don't remember on top of mind)
Especially for certain inputs I recommend using the OOTB modules provided with Filebeat as these will handle the parsing, log ingest etc for you.
smam
February 3, 2022, 8:15am
3
Hi,
Seems I did not specify that enough..
My VM is going to receive some Windows Event Log-Files from a selection of machines. These files are ment to be stored in Elasticsearch.
But the winlog.yml only contains Security/Application/.. and the addition of a path does not result in data beeing sent.
So to clarify:
I want to know where I should set the Path for the Files I want to send.
smam
February 3, 2022, 9:03am
4
This is what I tried so far
windows.event_logs:
- name: C:/path/to/file
- name: C:\path\to\file
- name: "C:/path/to/file"
- name: "C:\path\to\file"
I also tried:
\winlogbeat.exe -e -c .\winlogbeat-evtx.yml -E EVTX_FILE=<specific_evtx_file_path>
But neither worked. Is it possible at all to just send one stored file?
smam
February 3, 2022, 12:26pm
5
Ok, I did it.
I deleted every index and then made it work with:
windows.event_logs:
- name: C:/path/to/file
So in conclusion:
Some weird error happened before.
system
(system)
Closed
March 3, 2022, 12:26pm
6
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.