I am trying to ingest DNSServer Analytics logs to my ELK stack (V-8.14) but the logs are not getting ingested, below is the configurations i added in my elastic-agent.yml file:
Are you using filebeat or the integration to try this out?
Something to check out is if you have the events enabled, since DNS Analytical events are disabled by default. You need to follow the guide in order to enable them.
I was able to get the DNSServer Analytics data with ETW configuration,
but observed that the data stops when elastic agent restarts.
when i investigate i see error log that :
Input 'etw' failed with: realtime session could not be created: session already exists: Cannot create a file when that file already exists.
so etw creates a session and collects data, but when agent is restarted, it is not able create a new session or get data from existing session.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.