Using Winlogbeat for custom logfiles?

Elastic Stack Beats
6

Yeah Winlogbeat is dedicated to Windows Event logs. For your Application logs you can use Filebeat https://www.elastic.co/products/beats to send your application log data to Elastic.

Alternatively to Filebeat you can use the "File" input plugin (included by default) in Logstash https://www.elastic.co/products/logstash. Logstash is the heavy duty option in that it has plenty of options to perform a lot transformation and filtering (can use grok) on the data before it sends it on to Elastic. So depending on your situation, Filebeat may suffice.

An example of using the Logstash file input plugin to add fields to log entries from an application (called Crystal in this case) log file using a wildcard as the log filenames contain a date stamp. Also note because I have used a wildcard I have to use forward slashes for the Windows path:

# Input from Crystal Logs

input {
     file {
           type => "Crystal"
           path => "C:/Logs/Crystal*.log"
          }
}

# Transformation Section to add extra Fields to Crystal log events

filter {

  if [type] == "Crystal" {
       mutate {
          add_field => { 
       		           "env" => "qa"
       		           "region" => "UK"
                       }
                }
          }
}

# Output to Elastic Search section

output {
    elasticsearch  {
                hosts => "xxx.xxx.xxx.xxx"
                index => "logstash-crystal-%{+YYYY.MM.DD}" 
       	           }
}

There is no way to use any of the Beats or Logstash to housekeep the log files that it processes. Might be a useful feature request!