Windows Event pipelines - beats vs agent

[leandrojmp (Leandro Pereira)]

@rugenl

Where does the processing from the winlogbeat pipelines happen for agent data?

The logs-winlog* pipelines are part of the Windows Custom Events integration, it is used for custom logs.

The processing that was done by Winlogbeat is now split between the System and the Windows integration.

For example, the Application, System and Security Event Channels are processed by the System integration, and the Powershell, AppLocker etc are processed by the Windows integration.

You can check the pipelines here and here