Winlogbeat and Grafana Loki

Elastic Observability
1

Hello,
I want to send Windows Event ID 4066 to Grafana Loki server with IP address 192.168.1.2 via Winlogbeat. I wrote the following configuration file:

winlogbeat.event_logs:
  - name: Application
    event_id: 4066
  - name: Security
    event_id: 4066
  - name: System
    event_id: 4066

output.loki:
  hosts: ["http://192.168.1.2:3100"]
  labels:
    job: "windows_event_logs"
  static_labels:
    source: "windows"
    event_id: "4066"

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: {}
  - add_docker_metadata: {}
  - add_kubernetes_metadata: {}
  - drop_event:
      when:
        not:
          equals:
            event.id: 4066

When I try to restart the winlogbeat service, I get error 1053.

How to solve it?

Thank you.

2

There is no output.loki, Winlogbeat or any other beats, does not support sending data directly to Loki, not sure from where you got this configuration as this does not exist.

The supported outputs are mentioned here.

1 Like
3

Hi,
Thank you so much.