I have an ELK 8.0.0 series. I am testing the build of windows logs using winlogbeat 8.0.0. As I understand from the elastic documentation, the parsing of raw windows events will be by means of Security, PowerShell, Sysmon modules(Modules | Winlogbeat Reference [8.0] | Elastic). Based on this information, I collected a config.
Studying the problem, I found in the elasticsearch.yml config that the ingest role was missing from the assigned roles. I thought that I had finally found the root of the problem, but I hurried to rejoice by specifying ingest in node.roles, the problem was not solved
You deleted the ingest pipelines and still got data in your cluster? Winlogbeat should fail if a ingest pipeline that it uses while sending data does not exists.
Yes, I am deleting pipelines, but the data is still being written to the index. at that time, no errors are recorded in the winlogbeat log
Have you tried sending it without changing the index name? Using the default one.
yes, I tried writing to the standard index that is created after starting winlogbeat (index name: winlogbeat-8.0.0), but nothing has changed. There are no errors in the winlogbeat log either, even with debug logging mode enabled
Can you share the template winlogbeat ?
Yes, I can. It's too big, I put it in my git, please take a look